CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- mozilla firefox, firefox esr, thunderbird +2 moreKeyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread...6.5 Medium
- zulip, zulip server +1 moreNon-constant-time SCIM token comparison in Zulip Server3.7 Low
- mozilla firefox, firefox esr, thunderbird +2 moreService Workers should not be able to infer information about opaque cross-origin responses; but...6.5 Medium
- cisco firepower threat defense software, secure firewall threat defense +1 moreA vulnerability in the TLS handler of Cisco Firepower Threat Defense (FTD) Software could allow...5.3 Medium
- bluetooth core specificationAn information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in...4.3 Medium
- lanner inc iac-ast2500a, lannerinc iac-ast2500a firmware +1 moreUsername Enumeration5.3 Medium
- opencrxOpenCRX vulnerable to password enumeration via error messages in password reset5.3 Medium
- jenkins generic webhook trigger, jenkins project generic webhook trigger plugin +1 moreNon-constant time webhook token comparison in Jenkins Generic Webhook Trigger Plugin5.3 Medium
- jenkins gitlab, jenkins project gitlab plugin +1 moreNon-constant time webhook token comparison in Jenkins GitLab Plugin5.3 Medium
- johnson controls c•cure 9000, johnsoncontrols c-cure 9000 firmware +1 moreCCURE Observable Response Discrepancy4.3 Medium
- unknown wp 2faWP 2FA < 2.3.0 - Time-Based Side-Channel Attack5.9 Medium
- nediIn certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could...9.1 Critical
- mediawikiAn issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x...5.3 Medium
- amperecomputing ampere altra firmware, ampere altra max firmware, ampereone firmware +2 moreAmpere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which...6.5 Medium
- rocket.chatAn information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the...4.3 Medium
- typo3User Enumeration via Response Timing in TYPO35.3 Medium
- plextracThe PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response...5.3 Medium
- codesys visualizationCODESYS Visualization vulnerable to user enumeration5.3 Medium
- amperecomputing ampere altra firmware, ampere altra max firmware +1 moreAmpere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to...7.8 High
- google androidIn Framework, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn ActivityManager, there is a possible way to determine whether an app is installed, without...3.3 Low
- google androidIn PackageInstaller, there is a possible way to determine whether an app is installed, without...3.3 Low
- google androidIn ContentResolver, there is a possible way to determine whether an app is installed, without...3.3 Low
- google androidIn PackageInstaller, there is a possible way to determine whether an app is installed, without...3.3 Low
- google androidIn AlarmManagerService, there is a possible way to determine whether an app is installed, without...3.3 Low
- google androidIn Content, there is a possible way to determinate the user's account due to side channel...5.5 Medium
- google androidIn LauncherApps, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn AppOpsService, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn DevicePolicyManager, there is a possible way to determine whether an app is installed, without...5.5 Medium
- google androidIn DevicePolicyManager, there is a possible way to determine whether an app is installed, without...5.5 Medium
- google androidIn DevicePolicyManager, there is a possible way to determine whether an app is installed, without...5.5 Medium
- google androidIn DevicePolicyManager, there is a possible way to determine whether an app is installed, without...5.5 Medium
- google androidIn PackageManager, there is a possible way to determine whether an app is installed, without...3.3 Low
- google androidIn LocaleManager, there is a possible way to determine whether an app is installed, without query...3.3 Low
- google androidIn LocaleManager, there is a possible way to determine whether an app is installed, without query...3.3 Low
- google androidIn Telephony, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- google androidIn USB Manager, there is a possible way to determine whether an app is installed, without query...5.5 Medium
- cisco adaptive security appliance software, adaptive security appliance (asa) software, secure firewall threat defense +2 moreCisco Adaptive Security Appliance Software and Firepower Threat Defense Software RSA Private Key Leak Vulnerability7.4 High
- amd processors, athlon 3050ge firmware, athlon 3150g firmware +177 more +179 moreExecution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU...5.6 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +12 more +14 moreWindows Defender Credential Guard Information Disclosure Vulnerability4.7 Medium
- google chrome, fedoraproject fedora +1 moreSide-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79...6.5 Medium
- runatlantis atlantisTiming Attack7.5 High
- jenkins github, jenkins project github plugin +1 moreJenkins GitHub plugin uses weak webhook signature function5.3 Medium
- mealieThe login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by...5.3 Medium
- fastify bearer-auth, fastify-bearer-auth +1 morePotential Timing Attack Vector in @fastify/bearer-auth7.5 High
- cisco unified communications manager, unity connection +1 moreCisco Unified Communications Products Timing Attack Vulnerability5.3 Medium
- mozilla firefoxThe MediaError message property should be consistent to avoid leaking information about cross...7.5 High
- melag ftp serverA user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid...5.3 Medium
- jenkinsObservable timing discrepancy allows determining username validity in Jenkins7.5 High
- intel *Observable behavioral in power management throttling for some Intel(R) Processors may allow an...6.5 Medium
- Show moreLoading…