CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- amd processors, a10-9600p firmware, a10-9630p firmware +140 more +142 moreA potential vulnerability in some AMD processors using frequency scaling may allow an...6.5 Medium
- siemens sinema remote connect serverA vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An...5.9 Medium
- opswat metadefenderAs a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore)...4.3 Medium
- zyxel gs1200-5 firmware, gs1200-5hp firmware, gs1200-8 firmware +2 more +4 moreAn improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could...6.2 Medium
- linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreThe Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source...3.3 Low
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have exploited a timing attack by sending a large number of allowCredential...6.5 Medium
- intel atom processors firmware, celeron processors firmware, core processors firmware +5 more +7 moreObservable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to...5.5 Medium
- amd processors, epyc 7001 firmware, epyc 7002 firmware +97 more +99 moreAn attacker with access to a malicious hypervisor may be able to infer data values used in a SEV...6.5 Medium
- siemens desigo dxr2, desigo pxc3, desigo pxc4 +5 more +7 moreA vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 ...5.3 Medium
- constantoine totp-rsObservable Timing Discrepancy in totp-rs4.2 Medium
- splunk, splunk enterprise +1 moreUsername enumeration through lockout message in REST API5.3 Medium
- interlogix comnav, carrier hills comnav firmware +1 moreHills ComNav Inadequate Encryption Strength6.2 Medium
- waycrate swhkdExposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon3.3 Low
- ibm mq applianceIBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due...5.3 Medium
- google chromeInappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a...6.5 Medium
- google chromeInappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60...6.5 Medium
- google androidIn ContextImpl, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn WallpaperManagerService, there is a possible way to determine whether an app is installed,...5.5 Medium
- google androidIn TelecomManager, there is a possible way to check if a particular self managed phone account...5.5 Medium
- google androidIn People, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn VpnManagerService, there is a possible disclosure of installed VPN packages due to side...5.5 Medium
- google androidIn Settings, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn Media, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn AudioService, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn Framework, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn DevicePolicyManager, there is a possible way to reveal the existence of an installed package...5.5 Medium
- google androidIn DevicePolicyManager, there is a possible way to determine whether an app is installed, without...5.5 Medium
- google androidIn DevicePolicyManager, there is a possible way to determine whether an app is installed, without...5.5 Medium
- statamic cms, statamic +1 moreDiscoverability of user password hash in Statamic CMS3.7 Low
- mozilla firefoxWhile the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was...4.3 Medium
- siemens ruggedcom i800, ruggedcom i801, ruggedcom i802 +88 more +90 moreA vulnerability has been identified in RUGGEDCOM ROS M2100 (All versions < V5.6.0), RUGGEDCOM ROS...7.5 High
- home-assistantAn information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised...7.5 High
- occlum project occlumThe pointer-validation logic in util/mem_util.rs in Occlum before 0.26.0 for Intel SGX acts as a...5.5 Medium
- qlik sense, qlik sense enterprise on windows +1 moreQlik Sense Enterprise Domain User enumeration5.3 Medium
- sourcegraphSide-channel attack in Sourcegraph Code Monitors6.5 Medium
- snipe snipe/snipe-it, snipeitapp snipe-it +1 moreObservable Discrepancy in snipe/snipe-it5.3 Medium
- google androidIn isServiceDistractionOptimized of CarPackageManagerService.java, there is a possible disclosure...5.5 Medium
- servicenowThe password-reset form in ServiceNow Orlando provides different responses to invalid...5.3 Medium
- google chromeInappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote...4.3 Medium
- ibm guardium data encryption, security guardium data encryption +1 moreIBM Guardium Data Encryption (GDE) 5.0.0.2 behaves differently or sends different responses under...3.7 Low
- dpgaspar flask-appbuilderObservable Response Discrepancy in Flask-AppBuilder5.3 Medium
- adenza axiomsl controllerviewAdenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can...5.3 Medium
- bromiteIn Bromite through 78.0.3904.130, there are adblock rules in the release APK; therefore, probing...5.3 Medium
- w1.fi hostapd, fedoraproject fedora, siemens sidis secured smartplug +1 more +3 moreThe implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are...9.8 Critical
- w1.fi hostapd, fedoraproject fedora, siemens sidis secured smartplug +1 more +3 moreThe implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable...9.8 Critical
- jenkins configuration as code, jenkins project configuration as code plugin +1 moreObservable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin5.3 Medium
- nocodbNocoDB - Observable Discrepancy in the password-reset feature5.3 Medium
- zohocorp manageengine adselfservice plusManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in...5.3 Medium
- utimf uti mutual fund invest onlineAn issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers...5.3 Medium
- sonicwall sma100, sma 100 firmware, sma 200 firmware +4 more +6 moreA vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker...7.5 High
- Show moreLoading…