Merge pull request #1056 from mickhawkins/main

[docs] Add security announcements to 4.4.1 and friends

Author: mattporritt

general/releases/4.1/4.1.11.md

@@ -18,5 +18,10 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-24-0021](https://moodle.org/mod/forum/discuss.php?d=459498) - BigBlueButton web service leaks meeting joining information to users who should not have access
+- [MSA-24-0022](https://moodle.org/mod/forum/discuss.php?d=459499) - Stored XSS via calendar's event title when deleting the event
+- [MSA-24-0023](https://moodle.org/mod/forum/discuss.php?d=459500) - HTTP authorization header is preserved between "emulated redirects"
+- [MSA-24-0024](https://moodle.org/mod/forum/discuss.php?d=459501) - CSRF risks due to misuse of confirm_sesskey
+- [MSA-24-0025](https://moodle.org/mod/forum/discuss.php?d=459502) - QR login key and auto-login key for the Moodle mobile app should be generated as separate keys
+<!-- cspell:enable -->

general/releases/4.2/4.2.8.md

@@ -19,5 +19,10 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-24-0021](https://moodle.org/mod/forum/discuss.php?d=459498) - BigBlueButton web service leaks meeting joining information to users who should not have access
+- [MSA-24-0022](https://moodle.org/mod/forum/discuss.php?d=459499) - Stored XSS via calendar's event title when deleting the event
+- [MSA-24-0023](https://moodle.org/mod/forum/discuss.php?d=459500) - HTTP authorization header is preserved between "emulated redirects"
+- [MSA-24-0024](https://moodle.org/mod/forum/discuss.php?d=459501) - CSRF risks due to misuse of confirm_sesskey
+- [MSA-24-0025](https://moodle.org/mod/forum/discuss.php?d=459502) - QR login key and auto-login key for the Moodle mobile app should be generated as separate keys
+<!-- cspell:enable -->

general/releases/4.3/4.3.5.md

@@ -59,5 +59,10 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-24-0021](https://moodle.org/mod/forum/discuss.php?d=459498) - BigBlueButton web service leaks meeting joining information to users who should not have access
+- [MSA-24-0022](https://moodle.org/mod/forum/discuss.php?d=459499) - Stored XSS via calendar's event title when deleting the event
+- [MSA-24-0023](https://moodle.org/mod/forum/discuss.php?d=459500) - HTTP authorization header is preserved between "emulated redirects"
+- [MSA-24-0024](https://moodle.org/mod/forum/discuss.php?d=459501) - CSRF risks due to misuse of confirm_sesskey
+- [MSA-24-0025](https://moodle.org/mod/forum/discuss.php?d=459502) - QR login key and auto-login key for the Moodle mobile app should be generated as separate keys
+<!-- cspell:enable -->

general/releases/4.4/4.4.1.md

@@ -76,5 +76,10 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-24-0021](https://moodle.org/mod/forum/discuss.php?d=459498) - BigBlueButton web service leaks meeting joining information to users who should not have access
+- [MSA-24-0022](https://moodle.org/mod/forum/discuss.php?d=459499) - Stored XSS via calendar's event title when deleting the event
+- [MSA-24-0023](https://moodle.org/mod/forum/discuss.php?d=459500) - HTTP authorization header is preserved between "emulated redirects"
+- [MSA-24-0024](https://moodle.org/mod/forum/discuss.php?d=459501) - CSRF risks due to misuse of confirm_sesskey
+- [MSA-24-0025](https://moodle.org/mod/forum/discuss.php?d=459502) - QR login key and auto-login key for the Moodle mobile app should be generated as separate keys
+<!-- cspell:enable -->