The following flaw was found in Jenkins:

Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master.

This flaw could allow unauthenticated remote attackers to run arbitrary code on Jenkins.

Mitigation:

https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-execution-0-day-jenkins-cli

External References:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

Jenkins User Interface (UI) contains an information disclosure vulnerability that allows users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages.

Luke Meyer of Red Hat reports:

Description of problem: The remote-user auth plugin provides an httpd config file intended to require authentication before setting the REMOTEUSER env var which is passed on to the plugin. However there are passthrough provisions for other forms of auth; in particular, the management console is allowed to set the X-Remote-User header on a request and have that transmuted to the REMOTEUSER env var (by virtue of being a non-proxied local request). When the REMOTEUSER env var is set, the remote-user plugin automatically trusts it. By combining the X-Remote-User header with one of the other passthrough triggers, any user can be impersonated without authenticating at all.

Additional info: Simple workaround: add this in the host httpd conf global config, e.g. at the end of /etc/httpd/conf.d/000002openshiftoriginbrokerproxy.conf:

RequestHeader unset X-Remote-User

libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1.

swagger-ui has XSS in key names

node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.