Dqh1

**Nome do Software Vulnerável e Versões Afetadas** Jenkins GitHub Plugin versões anteriores a 1.46.1 **Descrição** O processamento inadequado da URL do trabalho atual no JavaScript utilizado para validar o recurso "GitHub hook trigger for GITScm polling" permite que atacantes não anônimos com permissão Overall/Read executem um ataque de cross-site scripting (XSS) armazenado. XSS é uma falha onde scripts maliciosos são injetados em sites confiáveis. **Recomendações** Atualize para uma versão posterior a 1.46.0.

**Name of the Vulnerable Software and Affected Versions** SuiteCRM versions 7.15.0 and 8.9.2 **Description** SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A critical Remote Code Execution (RCE) issue exists, allowing authenticated administrators to execute arbitrary system commands. The issue is a bypass of a previous patch attempt for CVE-2024-49774. The underlying flaw resides in the `ModuleScanner.php` file, specifically in its PHP token parsing logic. The scanner incorrectly resets its internal state (`$checkFunction` flag) when encountering single-character tokens (such as =, ., or ;). This allows attackers to conceal dangerous function calls, like `system()` or `exec()`, using variable assignments or string concatenation, effectively bypassing the MLP security controls. **Recommendations** Update to SuiteCRM version 7.15.1 or 8.9.3.

**Name of the Vulnerable Software and Affected Versions** OpenProject versions prior to 17.2.0 **Description** OpenProject is a web-based project management software. Before version 17.2.0, an authenticated project member with BCF import permissions could upload a manipulated .bcf archive. The `<Snapshot>` value within the markup.bcf file could be altered to contain an absolute or traversal local path, such as '/etc/passwd' or '../../../../etc/passwd'. During import, this untrusted `<Snapshot>` value is used as `file.path` during attachment processing. This allows for arbitrary file reading (AFR) within the read permissions of the OpenProject application user, as local filesystem content can be read outside the intended ZIP scope. **Recommendations** Update to version 17.2.0 or later.