Crilwa

**Name of the Vulnerable Software and Affected Versions** Apache UIMA DUCC (affected versions not specified) **Description** The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a 'Command Injection' vulnerability. When using the Distributed UIMA Cluster Computing (DUCC) module of Apache UIMA, an authenticated user with permissions to modify core entities can cause command execution as the system user that runs the web process. This vulnerability only affects products that are no longer supported by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins JaCoCo Plugin versions 3.3.2 and earlier **Description** The issue is a stored cross-site scripting (XSS) vulnerability. It occurs because class and method names shown on the UI are not escaped, allowing attackers who can control input files for the 'Record JaCoCo coverage report' post-build action to exploit this vulnerability. **Recommendations** For versions 3.3.2 and earlier, update to version 3.3.2.1 or later, which escapes class and method names shown on the UI, addressing the stored cross-site scripting (XSS) vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins remote-jobs-view-plugin Plugin versions 0.0.3 and earlier **Description** The issue is related to the XML parser not being configured to prevent XML external entity (XXE) attacks. This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. **Recommendations** For Jenkins remote-jobs-view-plugin Plugin versions 0.0.3 and earlier, update to a version that configures its XML parser to prevent XML external entity (XXE) attacks. As a temporary workaround, consider restricting access to the plugin to minimize the risk of exploitation.

**Nome do software vulnerável e versões afetadas** Apache Jena SDB versões 3.17.0 e anteriores **Descrição** A vulnerabilidade permite um ataque de deserialização JDBC se o invasor conseguir controlar a URL JDBC utilizada ou fazer com que o servidor de banco de dados subjacente retorne dados maliciosos. Sabe-se que o driver JDBC do MySQL é vulnerável a esse tipo de ataque. Como resultado, um aplicativo que utilize o Apache Jena SDB pode estar sujeito a RCE (Execução Remota de Código) quando conectado a um servidor de banco de dados malicioso. O Apache Jena SDB está em EOL (Fim de Vida) desde dezembro de 2020. **Recomendações** Para resolver o problema, os usuários devem migrar para opções alternativas, como o Apache Jena TDB 2. Como solução temporária, considere restringir o acesso à URL JDBC vulnerável até que um patch esteja disponível. Evite usar o driver JDBC do MySQL no Apache Jena SDB até que o problema seja resolvido. Migre para o Apache Jena TDB 2 para minimizar o risco de exploração.