آخرین آسیب‌پذیری‌ها

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled …

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a use…

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthen…

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in …

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the cont…

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on…

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved…

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, allowing attackers with access to POST config.xml API endpoints to submit crafted `config.xml` files …

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.

Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches

Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs

Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint

Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions

Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation

Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing

Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service

Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration

Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

Session Smart Router: A malicious DHCP server causes information disclosure and a service crash during DHCP option parsing

Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default

Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Session Smart Router: Integer overflow causes denial of service during TLS certificate inspection

Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed