HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined in Jenkins core or plugins from an…

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run…

Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

PKIX draft CompositeVerifier accepts empty signature sequence as valid.

GOSTCTR implementation unable to process more than 255 blocks correctly

Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification

LDAP Injection Vulnerability in LDAPStoreHelper.java

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains tab or newline…