378 matches found
CVE-2026-91996: Missing Authentication for Critical Function
lamp-cloud through 5.10.0 whitelists the path pattern //anno/ for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath...
GHSA-WRHR-54P6-Q97F Jenkins Active Directory Plugin follows LDAP referrals by default
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution RCE on the Jenkins controller if...
Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution RCE on the Jenkins controller if...
PT-2026-55168
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution RCE on the Jenkins controller if...
RCE vulnerability from unvalidated LDAP referrals in active-directory
active-directory 2.41 and earlier follows LDAP referrals from the configured Active Directory server by default. These can forward to an RMI URL that causes Jenkins to deserialize attacker-controlled data, resulting in Remote Code Execution RCE on the Jenkins controller if deserialization "gadget...
CVE-2023-43488
The vulnerability allows a low privileged untrusted application to modify a critical system property that should be denied, in order to enable the ADB Android Debug Bridge protocol to be exposed on the network, exploiting it to gain a privileged shell on the device without requiring the physical...
CSRF vulnerability on the login form
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not require a cross-site request forgery CSRF token crumb for the URL handling interactive login HTTP requests, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to trick users into logging in ...
EUVD-2025-36648
Jenkins Eggplant Runner Plugin protection mechanism disabled...
EUVD-2019-6374
Malware in sbrugna...
EUVD-2019-6370
Malware in sbrugna...
EUVD-2019-6372
Malware in sbrugna...
EUVD-2019-6358
Malware in sbrugna...
EUVD-2018-0568
Malware in sbrugna...
EUVD-2019-6363
Malware in sbrugna...
EUVD-2019-6383
Malware in sbrugna...
EUVD-2019-6368
Malware in sbrugna...
EUVD-2019-6386
Malware in sbrugna...
EUVD-2019-6359
Malware in sbrugna...