https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 17:00:59 +0000 https://vulnerability.circl.lu/vuln/cve-2015-5254 <p>Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.</p> <p>Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.</p> https://vulnerability.circl.lu/vuln/cve-2015-5254 https://vulnerability.circl.lu/vuln/rhsa-2016:0489 <p>ObjectMessage: unsafe deserialization jenkins: Project name disclosure via fingerprints (SECURITY-153) jenkins: Public value used for CSRF protection salt (SECURITY-169) jenkins: XXE injection into job configurations via CLI (SECURITY-173) jenkins: Secret key not verified when connecting a slave (SECURITY-184) jenkins: Information disclosure via sidepanel (SECURITY-192) jenkins: Local file inclusion vulnerability (SECURITY-195) jenkins: API tokens of other users available to admins (SECURITY-200) jenkins: Queue API did show items not visible to the current user (SECURITY-186) jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206) jenkins: Stored XSS vulnerability in slave offline status message (SECURITY-214) jenkins: CSRF vulnerability in some administrative actions (SECURITY-225) jenkins: CSRF protection ineffective (SECURITY-233) jenkins: Jenkins plugin manager vulnerable to MITM attacks (SECURITY-234) jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)</p> <p>ObjectMessage: unsafe deserialization jenkins: Project name disclosure via fingerprints (SECURITY-153) jenkins: Public value used for CSRF protection salt (SECURITY-169) jenkins: XXE injection into job configurations via CLI (SECURITY-173) jenkins: Secret key not verified when connecting a slave (SECURITY-184) jenkins: Information disclosure via sidepanel (SECURITY-192) jenkins: Local file inclusion vulnerability (SECURITY-195) jenkins: API tokens of other users available to admins (SECURITY-200) jenkins: Queue API did show items not visible to the current user (SECURITY-186) jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206) jenkins: Stored XSS vulnerability in slave offline status message (SECURITY-214) jenkins: CSRF vulnerability in some administrative actions (SECURITY-225) jenkins: CSRF protection ineffective (SECURITY-233) jenkins: Jenkins plugin manager vulnerable to MITM attacks (SECURITY-234) jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)</p> https://vulnerability.circl.lu/vuln/rhsa-2016:0489