Description
Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.
Remediation
References
Related Vulnerabilities
WordPress Plugin Testimonial Multiple Vulnerabilities (2.2)
Java Denial of Service (DoS) Vulnerability (CVE-2018-3180)
WordPress Plugin WooCommerce PHP Object Injection (3.1.0)
WebLogic Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2018-10237)
WordPress Plugin DP Thumbnail TimThumb Arbitrary File Upload (1.0)