Crilwa

**Name of the Vulnerable Software and Affected Versions** Apache UIMA DUCC (affected versions not specified) **Description** The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as a 'Command Injection' vulnerability. When using the Distributed UIMA Cluster Computing (DUCC) module of Apache UIMA, an authenticated user with permissions to modify core entities can cause command execution as the system user that runs the web process. This vulnerability only affects products that are no longer supported by the maintainer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins JaCoCo Plugin versions 3.3.2 and earlier **Description** The issue is a stored cross-site scripting (XSS) vulnerability. It occurs because class and method names shown on the UI are not escaped, allowing attackers who can control input files for the 'Record JaCoCo coverage report' post-build action to exploit this vulnerability. **Recommendations** For versions 3.3.2 and earlier, update to version 3.3.2.1 or later, which escapes class and method names shown on the UI, addressing the stored cross-site scripting (XSS) vulnerability.

**Name of the Vulnerable Software and Affected Versions** Jenkins remote-jobs-view-plugin Plugin versions 0.0.3 and earlier **Description** The issue is related to the XML parser not being configured to prevent XML external entity (XXE) attacks. This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. **Recommendations** For Jenkins remote-jobs-view-plugin Plugin versions 0.0.3 and earlier, update to a version that configures its XML parser to prevent XML external entity (XXE) attacks. As a temporary workaround, consider restricting access to the plugin to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache Jena SDB versions 3.17.0 and earlier **Description** The issue allows for a JDBC Deserialisation attack if the attacker can control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver is known to be vulnerable to this class of attack. As a result, an application using Apache Jena SDB can be subject to RCE when connected to a malicious database server. Apache Jena SDB has been EOL since December 2020. **Recommendations** To resolve the issue, users should migrate to alternative options, such as Apache Jena TDB 2. As a temporary workaround, consider restricting access to the vulnerable JDBC URL until a patch is available. Avoid using the mySQL JDBC driver in Apache Jena SDB until the issue is resolved. Migrate to Apache Jena TDB 2 to minimize the risk of exploitation.