Maven Advisories.

Jenkins Contrast Continuous Application Security Plugin missing permission checks

• Broken access control

<3.12 · fixed in 3.12

Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability

• Cross-site request forgery (CSRF)

<3.12 · fixed in 3.12

Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE

• CWE-610

<=1.0.7 · no fixed version yet

Jenkins Zowe zDevOps Plugin has a CSRF vulnerability

• Cross-site request forgery (CSRF)

<=1.1.3.50.ve350c9b · no fixed version yet

Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability

• Cross-site request forgery (CSRF)

<=1.4 · no fixed version yet

Jenkins Assembla Plugin has a missing permission check

• Broken access control

<=1.4 · no fixed version yet

Jenkins Assembla Plugin has an XXE vulnerability

• Server-side request forgery (SSRF)

<=1.4 · no fixed version yet

Jenkins Git client Plugin has an OS command injection vulnerability on agents

• Command injection

<6.6.1 · fixed in 6.6.1

Jenkins Gitee Plugin missing permission checks

• Broken access control

<1292.v2559f2f3f2c0 · fixed in 1292.v2559f2f3f2c0

Jenkins Gitee Plugin has a cross-site request forgery vulnerability

• Cross-site request forgery (CSRF)

<1292.v2559f2f3f2c0 · fixed in 1292.v2559f2f3f2c0

Jenkins Contrast Continuous Application Security Plugin has a missing permission check

• Broken access control

<3.12 · fixed in 3.12

Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation

• Weak cryptography or TLS

<3.3.9 · fixed in 3.3.9

Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs

• Broken access control

<1292.v2559f2f3f2c0 · fixed in 1292.v2559f2f3f2c0

Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names

• Broken access control

<462.463 · fixed in 462.463

Jenkins External Workspace Manager Plugin has a path traversal vulnerability

• Path traversal

<1.4.0 · fixed in 1.4.0

Jenkins Active Directory Plugin has an LDAP injection vulnerability

• Other injection

<2.41.2 · fixed in 2.41.2

Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs

• Broken access control

<1967.1970 · fixed in 1967.1970

Jenkins Priority Sorter Plugin has a CSRF vulnerability

• Cross-site request forgery (CSRF)

<936.937.v5581d0b · fixed in 936.937.v5581d0b

Jenkins Script Security Plugin has a script security bypass vulnerability

• Other injection
• Code injection

<1402.1405.vc96e74964250 · fixed in 1402.1405.vc96e74964250

Jenkins Script Security Plugin sandbox bypass vulnerability

• CWE-693

<1402.1405.vc96e74964250 · fixed in 1402.1405.vc96e74964250

Jenkins EC2 Fleet Plugin has a missing permission check

• Broken access control

<4.2.3.540.va · fixed in 4.2.3.540.va

Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations

• Information disclosure

<1367 · fixed in 1367

Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability

• Cross-site request forgery (CSRF)

<4331.4333 · fixed in 4331.4333

Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability

• Cross-site request forgery (CSRF)

<4.2.3.540.va · fixed in 4.2.3.540.va

Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types

• Code injection

<4331.4333 · fixed in 4331.4333

OHttpVersionChunkDraft: Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation

• CWE-325

<0.0.22.Final · fixed in 0.0.22.Final

Duplicate Advisory: OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

• Broken access control

* · no fixed version yet

Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

• Insecure deserialization

>=3.2.0, <=3.2.4 || >=4.0.0, <4.0.2 · fixed in 4.0.2

jackson-databind has @JsonView bypass for setterless creator properties

• Broken access control

>=2.21.0, <2.21.4 || >=3.0.0, <3.1.4 · fixed in 2.21.4, 3.1.4

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

• Broken access control

>=2.21.0, <2.21.4 || >=3.0.0, <3.1.4 · fixed in 2.21.4, 3.1.4

jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

• Broken access control

>=3.1.0, <3.1.4 || >=2.8.0, <2.18.9 || >=2.19.0, <2.21.5 || >=2.22.0, <2.22.1 · fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1

jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

• Server-side request forgery (SSRF)

>=2.0.0, <2.18.8 || >=2.19.0, <2.21.4 || >=3.0.0, <3.1.4 · fixed in 2.18.8, 2.21.4, 3.1.4

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

• CWE-184

>=2.10.0, <2.18.8 || >=2.19.0, <2.21.4 || >=3.0.0, <3.1.4 · fixed in 2.18.8, 2.21.4, 3.1.4

jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiation

• Insecure deserialization
• CWE-184

>=2.10.0, <2.18.8 || >=3.0.0, <3.1.4 || >=2.19.0, <2.21.4 · fixed in 2.18.8, 3.1.4, 2.21.4

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

• Denial of service

>=2.10.0, <2.14.0 · fixed in 2.14.0

jackson-databind has a @JsonView bypass for unwrapped creator parameters

• Broken access control

>=2.21.0, <2.21.4 · fixed in 2.21.4

OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet

• Information disclosure

<16.1.1 · fixed in 16.1.1

OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC

• Information disclosure
• Broken access control

<16.1.1 · fixed in 16.1.1

expr-eval vulnerable to Code Execution

• Code injection

<=2.0.2 · no fixed version yet

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

• Insecure deserialization

<5.1.1 · fixed in 5.1.1

Spinnaker has non-safe yaml deserialization, allowing RCE when using specific types

• Code injection
• Insecure deserialization

<2025.3.3 || >=2025.4.0, <2025.4.4 || >=2026.0.0, <2026.0.3 · fixed in 2025.3.3, 2025.4.4, 2026.0.3

OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget`

• Cross-site scripting (XSS)

<16.1.1 · fixed in 16.1.1

OpenAM has pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)

• Cross-site scripting (XSS)

>=13.0.0, <16.1.1 · fixed in 16.1.1

OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

• Server-side request forgery (SSRF)

<16.1.1 · fixed in 16.1.1

xwiki-pro-macros has remote code execution from page title and content via excerpt-include macro

• Code injection

>=1.13, <1.14.5 · fixed in 1.14.5

OpenAM has LDAP Injection via `_queryId` Parameter

• Other injection

<16.1.1 · fixed in 16.1.1

Apache Atlas UI: Authenticated User XSS

• Cross-site scripting (XSS)

<2.5.0 · fixed in 2.5.0

Apache NiFi: Missing authorization when replacing Process Groups with restricted components

• Broken access control

>=1.12.0, <2.9.0 · fixed in 2.9.0

Apache NiFi allows read-only users to submit component configuration verification request

• Broken access control

>=1.15.0, <2.10.0 · fixed in 2.10.0

Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL

• CWE-116

>=1.2.0, <2.10.0 · fixed in 2.10.0

Apache NiFi fails to validate proxy host headers when constructing qualified URLs

• CWE-346

<2.10.0 · fixed in 2.10.0

OpenRemote Manager: removeAlarms cross-realm IDOR (bulk delete)

• Broken access control

<1.25.0 · fixed in 1.25.0

http4k: `ServerFilters.DigestAuth` / `DigestAuthProvider` defaulted to an always-true nonce verifier, disabling replay protection in default deployments

• Authentication bypass

>=6.0.0.0, <6.48.0.0 || >=5.0.0.0, <5.42.0.0 || <4.51.0.0 · fixed in 6.48.0.0, 5.42.0.0, 4.51.0.0

http4k: BasicCookieStorage` (renamed `InsecureCookieStorage`) did not enforce RFC 6265 cookie scoping; new `DefaultCookieStorage` is now the default

• Information disclosure

>=6.0.0.0, <6.48.0.0 || >=5.0.0.0, <5.42.0.0 || <4.51.0.0 · fixed in 6.48.0.0, 5.42.0.0, 4.51.0.0

http4k: `HmacSha256.hash` (despite the `Hmac` naming) computed a plain unkeyed digest; clarified by deprecation in favour of `Sha256.hash` / `Sha256.hmac`

• CWE-345

<6.49.0.0 · fixed in 6.49.0.0

http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`

• HTTP request smuggling

>=6.0.0.0, <6.49.0.0 || >=5.0.0.0, <5.42.0.0 || <4.51.0.0 · fixed in 6.49.0.0, 5.42.0.0, 4.51.0.0

Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering

• Cross-site scripting (XSS)

<2.39.0 · fixed in 2.39.0

Allure Report: Path Traversal in HTTP Server Allows Arbitrary File Read

• Path traversal

<2.39.0 · fixed in 2.39.0

CedarJava has policy injection vulnerability

• Code injection

<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0 · fixed in 2.3.6, 3.4.1, 4.9.0

CedarJava has type confusion vulnerability

• Memory corruption

<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0 · fixed in 2.3.6, 3.4.1, 4.9.0