CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- open-emr openemr OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading 5.3 Medium
- opentext directory services (otds) A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse... 7.1 High
- google chrome Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker... 5.3 Medium
- google chrome Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker... 6.5 Medium
- google chrome Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker... No score
- google chrome Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker... 5.3 Medium
- gitea Gitea contribution heatmap private activity disclosure to public-only tokens 5.3 Medium
- google android In multiple locations, there is a possible side channel information leak due to improperly used... 4.3 Medium
-
github.com/charmbracelet/soft-serveGo charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories 5.3 Medium - google chrome Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to... 8.8 High
- google chrome Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to... 9.6 Critical
- appsup-dart jose Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose 5.9 Medium
- splunk soar Information Disclosure through REST API Authentication in Splunk SOAR 5.9 Medium
- grokability snipe-it Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint 5.1 Medium
- google chrome Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker... 8.8 High
- google chrome Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 8.8 High
- google chrome Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 8.8 High
- google chrome Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 9.6 Critical
- google chrome Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote... 9.6 Critical
- google chrome Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 8.8 High
- google chrome Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 8.8 High
- google chrome Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 8.8 High
- google chrome Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to... 9.6 Critical
- google chrome Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.47 allowed a... 8.8 High
- wso2 identity server, email otp authenticator, carbon abstract otp authenticator +2 more Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Account Discovery 5.3 Medium
- mattermost, mattermost server +1 more Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status 4.3 Medium
- google chrome Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker... 3.1 Low
- microsoft .net framework, .net framework 3.5, .net framework 3.5 and 4.6.2/4.7/4.7.1/4.7.2 +35 more +37 more Active Directory Federation Services (AD FS) Information Disclosure Vulnerability 7.5 High
- microsoft sharepoint server subscription edition, sharepoint server +1 more Microsoft Office SharePoint Tampering Vulnerability 6.8 Medium
- red hat hardened images Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds 3.7 Low
- surrealdb SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause 5.3 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 more Backstage: Improper input validation in scaffolder task list ordering 5.3 Medium
- google chrome Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed... 5.3 Medium
- google chrome Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote... 3.1 Low
- google chrome Observable discrepancy in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker... 4.3 Medium
- google chrome Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote... 5.3 Medium
- google chrome Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote... 3.1 Low
- softtr informatics trading limited company e-commerce pack User Enumeration in Softtr's E-Commerce Pack 5.3 Medium
- tryghost ghost Ghost: Invite Token Disclosure in Ghost Admin API 7.5 High
- tryghost ghost Ghost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin API 7.7 High
- tryghost ghost Ghost: Password Hash Ordering Disclosure in Ghost Admin API 3.1 Low
- tryghost ghost Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API 2.3 Low
- bouncycastle bc-csharp Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap 8.2 High
- bouncycastle bc-csharp IesEngine block-cipher mode checks padding before MAC (CBC padding oracle) 8.2 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 more Rubygem-katello: improper authorization logic allows resource enumeration 4.3 Medium
- tryghost ghost Ghost 5.42.2 before 6.58.0 Password Hash Disclosure 5.3 Medium
- tryghost ghost Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API 8.7 High
- zammad Zammad: Missing rate limiting allows password brute-forcing during two-factor login 6.9 Medium
- dgtlmoon changedetection.io dgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancy 6.3 Medium
- google chrome Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker... 5.3 Medium
- Show olderLoading…