VulnerableCode Package Details - pkg:rpm/redhat/jenkins-plugin-credentials@1.24-2?arch=el7

Search for packages

Vulnerability	Summary	Fixed by
VCID-3keu-g1gc-kyhf Aliases: CVE-2016-0791 GHSA-jmw7-ph6p-33cc	Information Exposure Jenkins does not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.	There are no reported fixed by versions.
VCID-4tt7-hwz7-nfhf Aliases: CVE-2016-0792 GHSA-45rg-g72w-r393	Jenkins allows Deserialization of Untrusted Data via an XML File Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.	There are no reported fixed by versions.
VCID-891k-xz71-guc5 Aliases: CVE-2016-0788 GHSA-j7q5-h445-f7pc	Jenkins allows Execution of Code by Opening a JRMP Listener The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.	There are no reported fixed by versions.
VCID-p7v4-63fw-kqaj Aliases: CVE-2016-0790 GHSA-jgpr-qrw2-6gp3	Information Exposure Jenkins does not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.	There are no reported fixed by versions.
VCID-y5vs-8bqz-sqf5 Aliases: CVE-2016-0789 GHSA-8p3c-m625-wh83	Jenkins has CRLF Injection Vulnerability in the CLI CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-3keu-g1gc-kyhf
Aliases:
CVE-2016-0791
GHSA-jmw7-ph6p-33cc

Information Exposure Jenkins does not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.