CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- oneidentity password managerAn issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid...5.3 Medium
- amd energy driver for linuxA potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to...5.5 Medium
- xen, debian linux, fedoraproject fedora +2 moreXen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES...4.4 Medium
- debian linux, fedoraproject fedora, intel celeron 3855u firmware +298 more +300 moreObservable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged...5.5 Medium
- bouncycastle fips java api, legion-of-the-bouncy-castle +1 moreObservable Differences in Behavior to Error Inputs in Bouncy Castle5.3 Medium
- cisco adaptive security appliance (asa) software, firepower threat defense, adaptive security appliance software +1 more +3 moreCisco Firepower 1000 Series Bleichenbacher Attack Vulnerability5.3 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: EX4600, QFX5K Series: Stateless firewall filter matching 'user-vlan-id' will cause incomplete discard action5.8 Medium
- ibm security access manager, security verify access +1 moreIBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker...5.3 Medium
- ibm security access manager, security verify access +1 moreIBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker...5.3 Medium
- ibm security access manager, security verify access +1 moreIBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker...5.3 Medium
- sonicwall sonicos, sonicosv +1 moreSonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management...5.3 Medium
- shrinerb shrineTiming attack in Shrine5.9 Medium
- pritunlPritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth...5.3 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +12 more +14 moreIn versions 13.0.0-13.0.0 HF2, 12.1.0-12.1.2 HF1, and 11.6.1-11.6.2, BIG-IP platforms with Cavium...5.9 Medium
- cisco ios xe software, ios xe +1 moreCisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers DHCP Denial of Service Vulnerability8.6 High
- linux4sam at91bootstrapA timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by...6.8 Medium
- microchip atsama5d21c-cu firmware, atsama5d21c-cur firmware, atsama5d225c-d1m-cur firmware +73 more +75 moreCMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable...7.5 High
- openssl, canonical ubuntu linux, debian linux +12 more +14 moreRaccoon attack3.7 Low
- arm mbed tls, debian linux, fedoraproject fedora +2 moreA Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted...5.5 Medium
- google androidAn issue was discovered on LG mobile devices with Android OS 4.4, 5.0, 5.1, 6.0, 7.0, 7.1, 8.0, 8...7.5 High
- umanni human resourcesUmanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery,...5.3 Medium
- magento, openmage magento-lts, long term support +2 moreObservable Timing Discrepancy in OpenMage LTS8.0 High
- microsoft windows 10 version 1809, windows 10 version 1903 for arm64-based systems, windows 10 version 1909 +2 more +4 moreWindows ARM Information Disclosure Vulnerability7.5 High
- p5-crypt-perl project p5-crypt-perlECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against...7.5 High
- mozilla firefox, firefox for android, firefox mobile +2 moreDuring ECDSA signature generation, padding applied in the nonce designed to ensure constant-time...4.7 Medium
- mozilla firefox, firefox for android, firefox mobile +2 moreWhen converting coordinates from projective to affine, the modular inversion was not performed in...4.7 Medium
- adobe magentoMagento observable timing discrepancy vulnerability4.2 Medium
- avertx hd438 firmware, hd838 firmware +1 moreAn issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838...5.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreSide-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed...4.3 Medium
- venki supravizio bpmA user enumeration vulnerability flaw was found in Venki Supravizio BPM 10.1.2. This issue occurs...5.3 Medium
- openbsd openssh, netapp active iq unified manager, aff a700s firmware +9 more +11 moreThe client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an...5.9 Medium
- putty, fedoraproject fedora, netapp oncommand unified manager core package +2 morePuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the...5.9 Medium
- adobe magentoMagento Signature verification bypass7.2 High
- wolfsslThe private-key operations in ecc.c in wolfSSL before 4.4.0 do not use a constant-time modular...5.3 Medium
- atlassian jira, jira server and data center, jira software data center +2 moreVersions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting...5.3 Medium
- mozilla firefox, debian linux, fedoraproject fedora +1 more +3 moreDuring RSA key generation, bignum implementations used a variation of the Binary Extended...4.4 Medium
- citrix xenapp** VERSION NOT SUPPORTED WHEN ASSIGNED ** Citrix XenApp 6.5, when 2FA is enabled, allows a remote...5.3 Medium
- arm cortex-a32 firmware, cortex-a34 firmware, cortex-a35 firmware +5 more +7 moreArm Armv8-A core implementations utilizing speculative execution past unconditional changes in...5.5 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8017 firmware +52 more +54 moreUsing non-time-constant functions like memcmp to compare sensitive data can lead to information...5.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreNSS has shown timing differences when performing DSA signatures, which was exploitable and could...4.4 Medium
- aviatrix controller, vpn client +1 moreAn issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response...5.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 more +4 moreInsufficient policy enforcement in Blink in Google Chrome prior to 83.0.4103.61 allowed a remote...6.5 Medium
- typo3, typo3 cms +1 moreObservable Response Discrepancy in TYPO3 CMS3.7 Low
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8017 firmware +47 more +49 moreDue to the use of non-time-constant comparison functions there is issue in timing side channels...5.5 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8016 firmware +50 more +52 moreSide channel issue in QTEE due to usage of non-time-constant comparison function such as memcmp...5.5 Medium
- arm mbed tls, debian linux, fedoraproject fedora +2 moreAn issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that...4.7 Medium
- wolfsslwolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing...7.5 High
- argoproj argo cdObservable Discrepancy in Argo5.3 Medium
- wago pfc100 firmware, pfc200 firmware +1 moreAn exploitable timing discrepancy vulnerability exists in the authentication functionality of the...5.3 Medium
- zammadAn issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is...5.3 Medium
- Show moreLoading…