All issues

Search results

[8.1.8] Compilation fails in the rxutils module because the PSBinary class cannot be resolved in PSBaseValue.java.

bugSomething isn't workingSomething isn't working

Status: Open.

Bug

#190In intersoftdatalabs-in/percussioncms-java8;

· vijaya-boddipudi opened on Sep 7, 2026

·

8.1.8

T2.6e commons-collections 3.2.2: disable unsafe deserialization via -Dorg.apache.commons.collections.enableUnsafeSerialization=false

Status: Open.

#176In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026

T2.6b commons-compress 1.28.0: add PSZipBombGuard to 2 unhardened install-time archive paths

Status: Open.

#174In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026

T2.6a commons-fileupload 1.6.0 hardening: add setFileCountMax + setHeaderEncoding + setSizeThreshold on the 2 sitemanage upload servlets

Status: Open.

#172In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026

T2.18 Derby 10.14.2.0 hardening: drop -noSecurityManager, add drda host/timeout/connectionLimit/SHA-256

Status: Open.

#170In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026

T2.3 CXF 3.5.11 hardening: replace <cxf:logging/> defaults with size-limited LoggingFeature

Status: Open.

#168In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026

T2.2 ActiveMQ 5.16.8 hardening: transport bind, frame size, advisorySupport, pendingMessageLimit, deleteAllMessagesOnStartup

Status: Open.

#166In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026

T2.4 follow-up: tighten StrictHttpFirewall + add missing headers to sitemanage main app + add X-Permitted-Cross-Domain-Policies / Permissions-Policy

Status: Open.

#164In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026

Migrate JCR API from 1.0 (JSR-170) to 2.0 (JSR-283): fix runtime/contract mismatch with jackrabbit-jcr-commons

Status: Open.

#162In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026

T2.16: remove unused AntiSamy (7 CVEs retired; ESAPI kept for output encoding only) (closes #155 dependency)

Status: Open.

#160In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026

Pin jackrabbit-jcr-commons at 2.20.x: 2.21+ requires Java 11 (closes #155)

Status: Open.

#158In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026

T2.15 MyFaces 2.3.11 hardening: SECRET, COMPRESS_VIEW_STATE, strict_jar_in_filesystem (2 CVEs)

Status: Open.

#156In intersoftdatalabs-in/percussioncms-java8;

· natechadwick-intsof opened on Sep 1, 2026