471 matches found
PT-2026-99872
Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions prior to 2.34.0 Description An unsafe reflection issue exists in the FederationStreamConnectMessage.getFederationPolicy function. The system calls Class.forNameclazz.getConstructor.newInstance using a clazz val...
CVE-2026-91996: Missing Authentication for Critical Function
lamp-cloud through 5.10.0 whitelists the path pattern //anno/ for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath...
artemis-core-client: Unsafe Reflection in Apache ActiveMQ Artemis Federation Message Deserialization
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...
artemis-core-client: Unsafe Reflection in Apache ActiveMQ Artemis Federation Message Deserialization
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy. The method calls Class.forNameclazz.getConstructor.newInstance where clazz is read directly from the CORE protocol wire buffer without type validation. An...
Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution RCE on the Jenkins controller if...
GHSA-WRHR-54P6-Q97F Jenkins Active Directory Plugin follows LDAP referrals by default
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution RCE on the Jenkins controller if...
PT-2026-55168
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution RCE on the Jenkins controller if...
RCE vulnerability from unvalidated LDAP referrals in active-directory
active-directory 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution RCE on the Jenkins controller if deserialization "gadget...
CVE-2023-43488
The vulnerability allows a low privileged untrusted application to modify a critical system property that should be denied, in order to enable the ADB Android Debug Bridge protocol to be exposed on the network, exploiting it to gain a privileged shell on the device without requiring the physical...
CSRF vulnerability on the login form
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not require a cross-site request forgery CSRF token crumb for the URL handling interactive login HTTP requests, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to trick users into logging in ...
EUVD-2025-36648
Jenkins Eggplant Runner Plugin protection mechanism disabled...
EUVD-2019-6370
Malware in sbrugna...
EUVD-2019-6374
Malware in sbrugna...
EUVD-2019-6359
Malware in sbrugna...
EUVD-2019-6392
Malware in sbrugna...
EUVD-2019-6393
Malware in sbrugna...
EUVD-2019-6369
Malware in sbrugna...
EUVD-2019-6368
Malware in sbrugna...