CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- wolfsslIn wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system...4.9 Medium
- arm mbed tls, debian linux, fedoraproject fedora +2 moreIn Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding...4.9 Medium
- dell storage managerQSAN Storage Manager - Exposure of Sensitive Information to an Unauthorized Actor5.3 Medium
- debian linux, linux kernel +1 moreIn kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g.,...4.7 Medium
- debian linux, fedoraproject fedora, intel celeron processors firmware +4 more +6 moreObservable response discrepancy in some Intel(R) Processors may allow an authorized user to...6.5 Medium
- intel brand verification tool, fedoraproject fedora, intel celeron processors firmware +4 more +6 moreImproper permissions in the installer for the Intel(R) Brand Verification Tool before version 11...6.5 Medium
- intel integrated performance primitives cryptography, sgx dcap, sgx psw +1 more +3 moreObservable timing discrepancy in Intel(R) IPP before version 2020 update 1 may allow authorized...4.7 Medium
- amd all supported processors, arm cortex-a72, broadcom bcm2711 +6 more +8 moreAMD Speculative execution with Floating-Point Value Injection5.5 Medium
- amd all supported processors, arm cortex-a72, broadcom bcm2711 +6 more +8 moreAMD Speculative Code Store Bypass5.5 Medium
- gnupg libgcrypt, debian linux, fedoraproject fedora +8 more +10 moreLibgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks...7.5 High
- debian linux, intel microcode, netapp fas\/aff bios +2 more +4 moreObservable timing discrepancy in some Intel(R) Processors may allow an authenticated user to...3.3 Low
- websockets project websockets, oracle communications cloud native core policy, communications cloud native core security edge protection proxy +2 more +4 moreObservable Timing Discrepancy in aaugustin websockets library5.9 Medium
- luca-app lucaLuca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID...7.5 High
- dpgaspar flask-appbuilder, apache airflow +1 moreObservable Response Discrepancy in Flask-AppBuilder5.3 Medium
- rocket.chatAn information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 &...7.5 High
- nordicsemi nrf52840 firmwareNordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against...5.7 Medium
- nordicsemi nrf52840 firmwareThe elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone®...5.5 Medium
- ibm security identity managerIBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a...3.7 Low
- bouncycastle bc-csharp, bouncy castle fips .net api, fips java api +1 more +3 moreTiming based private key exposure in Bouncy Castle5.9 Medium
- dlink dir-842e firmwareAn authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR...5.9 Medium
- sensiolabs symfony, fedoraproject fedora +1 morePrevent user enumeration using Guard or the new Authenticator-based Security5.3 Medium
- cisco sd-wan vmanage, catalyst sd-wan manager +1 moreCisco SD-WAN vManage HTTP Authentication User Enumeration Vulnerability5.3 Medium
- redmine, debian linux +1 moreRedmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal...5.3 Medium
- flow flow-server, vaadin flow, vaadin +2 moreTiming side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-184.0 Medium
- vaadin, vaadin vaadin-server +1 moreTiming side channel vulnerability in UIDL request handler in Vaadin 7 and 84.0 Medium
- flow flow-server, vaadin flow, vaadin +2 moreTiming side channel vulnerability in endpoint request handler in Vaadin 15-194.0 Medium
- jose-node-cjs-runtime project jose-node-cjs-runtimePadding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime5.9 Medium
- panva jose-node-esm-runtime, jose-node-cjs-runtime project jose-node-cjs-runtime +1 morePadding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime5.9 Medium
- appsup-dart jose, jose-node-cjs-runtime project jose-node-cjs-runtime +1 morePadding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime5.9 Medium
- appsup-dart josePadding Oracle Attack due to Observable Timing Discrepancy in jose5.9 Medium
- debian linux, linux kernel, canonical ubuntu linux +1 more +3 moreAn issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs...4.7 Medium
- apache hiveTiming attack in Cookie signature verification5.9 Medium
- ibexa ez platform kernelDuplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel5.3 Medium
ezsystems/ezplatform-restPackagist/user/sessions endpoint allows detecting valid accountsNo score- redhat 389 directory server, directory server, enterprise linux +2 moreWhen binding against a DN during authentication, the reply from 389-ds-base will be different...5.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreSide-channel information leakage in autofill in Google Chrome prior to 89.0.4389.72 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreSide-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72...6.5 Medium
- rangerstudio directus** UNSUPPORTED WHEN ASSIGNED ** In Directus 8.x through 8.8.1, an attacker can discover whether a...5.3 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000, ar8031 +327 more +329 moreAllowing RTT frames to be linked with non randomized MAC address by comparing the sequence...7.5 High
- squaredupA username enumeration issue was discovered in SquaredUp before version 4.6.0. The login...3.7 Low
- m2crypto project m2crypto, fedoraproject fedora, redhat enterprise linux +1 more +3 moreA flaw was found in all released versions of m2crypto, where they are vulnerable to...5.9 Medium
- rocket.chatAn email address enumeration vulnerability exists in the password reset function of Rocket.Chat...5.3 Medium
- ftsafe k13, k21, k40 +42 more +44 moreAn electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security...4.2 Medium
- google androidIn enforceDumpPermissionForPackage of ActivityManagerService.java, there is a possible way to...5.5 Medium
- dropbear ssh project sshDropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing...5.3 Medium
- mediawikiAn issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. The non-admin...5.3 Medium
- mediawiki, debian linux, fedoraproject fedora +2 moreAn issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and...5.3 Medium
- google androidDuring boot, the device unlock interface behaves differently depending on if a fingerprint...5.5 Medium
- xen, debian linux, fedoraproject fedora +2 moreAn issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any...2.3 Low
- google androidIn resolv_cache_lookup of res_cache.cpp, there is a possible side channel information disclosure....5.5 Medium
- Show moreLoading…