Tim Otten

Name of the Vulnerable Software and Affected Versions: jenkins-ssh-slaves-plugin versions prior to 1.15 Description: The issue allows for Man-in-the-Middle attacks due to the lack of host key verification. Recommendations: For versions prior to 1.15, update to version 1.15 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** CiviCRM versions 4.2.0 through 4.2.9 CiviCRM versions 4.3.0 through 4.3.3 **Description** The issue allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the Quick Search API, related to contact.getquick. **Recommendations** For CiviCRM versions 4.2.0 through 4.2.9, update to a version outside of this range to mitigate the risk. For CiviCRM versions 4.3.0 through 4.3.3, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the Quick Search API until a patch is available.

**Name of the Vulnerable Software and Affected Versions** CiviCRM versions prior to 4.2.12 CiviCRM versions 4.3.x prior to 4.3.7 CiviCRM versions 4.4.x prior to 4.4.beta4 **Description** The issue allows remote attackers to execute arbitrary SQL commands via the ` value` parameter to (1) "ajax/jqState" or (2) "ajax/jqcounty" API endpoints. This is a result of multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php. **Recommendations** For versions prior to 4.2.12, update to version 4.2.12 or later. For versions 4.3.x prior to 4.3.7, update to version 4.3.7 or later. For versions 4.4.x prior to 4.4.beta4, update to version 4.4.beta4 or later. As a temporary workaround, consider restricting access to the "ajax/jqState" and "ajax/jqcounty" API endpoints until a patch is applied. Avoid using the ` value` parameter in the affected API endpoints until the issue is resolved.