The following flaw was found in Jenkins:
Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master.
This flaw could allow unauthenticated remote attackers to run arbitrary code on Jenkins.
Mitigation:
https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11