Cross site request forgery (csrf)

Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b1154b3fb, uses a non-constant time comparison function when checking whether the provided and expected CSRF protection nonce are equal, potentially allowing attackers to use statistical methods to obtain a valid nonce...

Project party can unilaterally change price payed at task completion

Lines of code Vulnerability details Impact If there has been more than a change in a task's cost through mulitple calls to changeOrder, signatures previously passed can be replayed by one party to change the price payed for the task without consent of the other parties by frontrunning call to...

Timing Attack

github.com/hashicorp/vault is vulnerable to timing attacks. The application is vulnerable because they do not compare nonces in constant-time, which allows attackers to use the timing of the request to progressively identify a valid nonce...