CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- phpmyadmin, fedoraproject fedora, opensuse leap +1 more +3 morephpMyAdmin Unsafe comparison of XSRF/CSRF token7.5 High
- gnu gnutls, debian linux +1 moreGnuTLS incorrectly validates the first byte of padding in CBC modes5.9 Medium
- tornadoweb tornadoTornado XSRF cookie allows side-channel attack against TLS (BREACH attack)6.5 Medium
- gnu gnupg, libgcrypt, debian linux +2 moreThe mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to...5.9 Medium
- mozilla network security services, canonical ubuntu linux, oracle enterprise manager ops center +12 more +14 moreThe TLS implementation in Mozilla Network Security Services (NSS) does not properly consider...4.3 Medium
- bouncycastle bc-java, bouncy-castle-crypto-package +1 moreLegion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability10.0 High
- woppoware postmasterThe web mail service in Woppoware PostMaster 4.2.2 (build 3.2.5) generates different error...5.0 Medium
- adobe svg viewerThe NPSVG3.dll ActiveX control for Adobe SVG Viewer 3.02 and earlier, when running on Internet...5.0 Medium
- sophos astaro security linuxThe firewall in Astaro Security Linux before 4.024 sends responses to SYN-FIN packets, which...5.0 Medium
- nettica intellipeer email serverNettica Corporation INTELLIPEER Email Server 1.01 displays different error messages for valid and...5.0 Medium
- argosoft ftp serverArGoSoft FTP before 1.4.2.1 generates an error message if the user name does not exist instead of...5.0 Medium
- proftpdProFTPD 1.2.x, including 1.2.8 and 1.2.10, responds in a different amount of time when a given...5.0 Medium
- gnu cvsCVS 1.11.x before 1.11.17, and 1.12.x before 1.12.9, allows remote attackers to determine the...5.0 Medium
- yabbforumsoftware yet another bulletin boardYaBB 1 SP 1.3.1 displays different error messages when a user exists or not, which makes it...5.0 Medium
- ibm aixAIX 4.3.3 through AIX 5.1, when direct remote login is disabled, displays a different message if...5.0 Medium
- novell ichainNovell iChain 2.2 before Support Pack 1 uses a shorter timeout for a non-existent user than a...5.0 Medium
- openbsd openssh, openpkg, siemens scalance x204rna ecc firmware +1 more +3 moreOpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an...5.0 Medium
- openssl, freebsd, openbsd +2 moressl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a...5.0 Medium
- joetesta hellbentJoe Testa hellbent 01 allows remote attackers to determine the full path of the web root...5.0 Medium
- phildev ipfilterIPFilter 3.4.25 and earlier sets a different TTL when a port is being filtered than when it is...5.0 Medium
- openbsdPF in OpenBSD 3.0 with the return-rst rule sets the TTL to 128 in the RST packet, which allows...5.0 Medium
- network.associates pgpfirePGP Security PGPfire 7.1 for Windows alters the system's TCP/IP stack and modifies packets in...5.0 Medium
- amtote homebetAmTote International homebet program returns different error messages when invalid account...5.0 Medium
- nrl.navy one-time passwords in everythingOne-Time Passwords In Everything (a.k.a OPIE) 2.32 and 2.4 allows remote attackers to determine...5.0 Medium
- netfilter iptablesiptables-save in iptables before 1.2.4 records the "--reject-with icmp-host-prohibited" rule as "...2.1 Low
- ibm lotus notesThe Extended Control List (ECL) feature of the Java Virtual Machine (JVM) in Lotus Notes Client...5.0 Medium