CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- labvantageLabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example...5.3 Medium
- voatzIn the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single...5.3 Medium
- google chrome, debian linux, fedoraproject fedora +5 more +7 moreInappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote...6.5 Medium
- webcalendar project webcalendarwebcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").5.3 Medium
- jenkinsNon-constant time HMAC comparison5.3 Medium
- jenkinsNon-constant time comparison of inbound TCP agent connection secret5.3 Medium
- proxmox virtual environmentProxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability5.3 Medium
- connectwise controlAn issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....5.3 Medium
- arm mbed crypto, mbed tls, debian linux +1 more +3 moreThe ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1...4.7 Medium
- parity libsecp256k1Observable Discrepancy in libsecp256k1-rs5.9 Medium
- google androidIn DCRYPTO_equals of compare.c, there is a possible timing attack due to improperly used crypto....5.5 Medium
- mfscripts yetishare_account_forgot_password.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.3 takes a different...5.3 Medium
- rack, fedoraproject fedora, opensuse leap +2 morePossible Information Leak / Session Hijack Vulnerability in Rack6.3 Medium
- linux kernel, [unknown] linux kernel, redhat enterprise linux +2 moreA flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5...5.5 Medium
- trustedsec trevorc2TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response...7.5 High
- freeradius, opensuse leap, redhat enterprise linux +2 moreIn FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the...6.5 Medium
- simplito elliptic-phpTiming attacks might allow practical recovery of the long-term private key7.4 High
- sensiolabs symfony, fedoraproject fedora +1 moreSymfony Http-Kernel has non-constant time comparison in UriSigner8.1 High
- sensiolabs symfonyUser enumeration leak using switch user functionality in Symfony5.3 Medium
- st st33tphf20i2c firmware, st33tphf20spi firmware, st33tphf2ei2c firmware +1 more +3 moreSTMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the...5.9 Medium
- hyundai-pay kasse hk-1000 firmwareOn Hyundai Pay Kasse HK-1000 devices, a side channel for the row-based OLED display was found....4.6 Medium
- archos safe-tOn Archos Safe-T devices, a side channel for the row-based OLED display was found. The power...4.6 Medium
- shiftcrypto bitbox02On SHIFT BitBox02 devices, a side channel for the row-based OLED display was found. The power...4.6 Medium
- coinkite coldcard mk1 firmware, coldcard mk2 firmware +1 more** DISPUTED ** On Coldcard MK1 and MK2 devices, a side channel for the row-based OLED display was...5.3 Medium
- matrixsslMatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This...5.9 Medium
- wolfsslwolfCrypt leaks cryptographic information via timing side channel4.7 Medium
- athena-scs idprotect, microchip atmel toolbox, tecsec armored card +2 more +4 moreSmart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the...4.7 Medium
- dell rsa bsafe crypto-c micro edition, emc rsa bsafe crypto-c, dell bsafe crypto-c-micro-edition +2 more +4 moreRSA BSAFE Crypto-C Micro Edition, versions prior to 4.0.5.3 (in 4.0.x) and versions prior to 4.1...5.9 Medium
- dell rsa bsafe crypto-c micro edition, bsafe crypto-c-micro-edition, bsafe micro-edition-suite +1 more +3 moreRSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions...5.9 Medium
- f5 enterprise manager, iworkflow, big-ip, big-iq, iworkflow, enterprise manager +14 more +16 moreIn BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6...5.3 Medium
- pagekitPagekit User enumeration5.3 Medium
- google chromeInformation leak in storage in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to...7.4 High
- dell bsafe crypto-j, rsa bsafe crypto-j, bsafe cert-j +16 more +18 moreRSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through...6.5 Medium
- dell bsafe crypto-j, rsa bsafe crypto-j, bsafe cert-j +14 more +16 moreRSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing...6.5 Medium
- spip, canonical ubuntu linux, debian linux +2 moreSPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password...5.3 Medium
- apache tapestryTiming attack on HMAC signature comparison in Apache Tapestry9.8 Critical
- intenogroup eg200 firmwareInteno EG200 EG200-WU7P1U_ADAMO3.16.4-190226_1650 routers have a JUCI ACL misconfiguration that...6.5 Medium
- opensslPadding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey3.7 Low
- couchbase serverAn issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached ...5.3 Medium
- libgcrypt20 project libgcrypt20, canonical ubuntu linux, opensuse leap +3 more +5 moreIt was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library....6.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreNavigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft...3.7 Low
- control-webpanel webpanelIn CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers...5.3 Medium
- zabbix, debian linux +1 moreZabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to...5.3 Medium
- floragunn search guardSearch Guard versions before 21.0 had an timing side channel issue when using the internal user...5.9 Medium
- real-sec bc vault firmware** DISPUTED ** On BC Vault devices, a side channel for the row-based SSD1309 OLED display was...2.4 Low
- mooltipass mini firmware** DISPUTED ** On Mooltipass Mini devices, a side channel for the row-based OLED display was...2.4 Low
- shapeshift keepkey firmware** DISPUTED ** On ShapeShift KeepKey devices, a side channel for the row-based OLED display was...2.4 Low
- ledger nano s firmware, nano x firmware +1 moreOn Ledger Nano S and Nano X devices, a side channel for the row-based OLED display was found. The...2.4 Low
- trezor one firmwareOn Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The...4.2 Medium
- w1.fi hostapd, canonical ubuntu linux, debian linux +1 more +3 moreThe implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are...5.9 Medium
- Show moreLoading…