CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- sick ftmg-esd15axx firmware, ftmg-esd20axx firmware, ftmg-esd25axx firmware +11 more +13 moreObservable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215,...5.3 Medium
- ibm spectrum virtualizeIBM Spectrum Virtualize information disclosure5.9 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreA validation issue was addressed with improved input sanitization. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, tvos +3 more +5 moreThis issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13...5.5 Medium
- zyxel dx5401-b0 firmwareThe sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in...7.5 High
- northern.tech cfengineNorthern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to...6.5 Medium
- laravel frameworkThe authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be...5.3 Medium
- medicine tracker system project tracker systemA username enumeration issue was discovered in Medicine Tracker System 1.0. The login...5.3 Medium
- iofinnet tss-libIO FinNet tss-lib vulnerable to timing attack from non-constant time scalar arithmetic7.5 High
- iofinnet tss-libIO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication9.1 Critical
- glpi-project cmdbfront/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access...6.5 Medium
- slims senayan library management systemSENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded...7.5 High
- debian linux, linux kernel +1 moreSpectre v2 SMT mitigations problem in Linux kernel5.6 Medium
- mendix forgot password, siemens mendix forgot password (mendix 7 compatible), mendix forgot password (mendix 8 compatible) +1 more +3 moreA vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions...5.3 Medium
- mobymoby/moby's dockerd daemon encrypted overlay network may be unauthenticated7.5 High
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations5.0 Medium
- harpaitalia mcuboictAn issue was discovered in MCUBO ICT through 10.12.4 (aka 6.0.2). An Observable Response...7.5 High
- linuxfoundation argo-cdArgo CD authenticated but unauthorized users may enumerate Application names via the API4.3 Medium
- answer, answerdev answerdev/answer +1 moreObservable Response Discrepancy in answerdev/answer5.3 Medium
- answer, answerdev answerdev/answer +1 moreObservable Timing Discrepancy in answerdev/answer5.3 Medium
- amazon opensearch, opensearch security, embysupport security +2 moreTime discrepancy in authentication responses in OpenSearch5.3 Medium
- vantage6Observable Response Discrepancy in vantage65.3 Medium
- mozilla firefox, firefox esr +1 moreThe Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To...5.9 Medium
- mozilla firefoxWhen dragging and dropping an image cross-origin, the image's size could potentially be leaked....6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a...6.5 Medium
- gnu gnutls, debian linux, fedoraproject fedora +7 more +9 moreA timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS....7.4 High
- openssl, siemens scalance w1750d (jp), scalance w1750d (row) +8 more +10 moreTiming Oracle in RSA Decryption5.9 Medium
- healthchecks, healthchecks healthchecks/healthchecks +1 moreObservable Discrepancy in healthchecks/healthchecks5.3 Medium
- jopenid project jopenidmichaelliao jopenid OpenIdManager.java getAuthentication timing discrepancy2.6 Low
- nvidia dgx a100 firmware, dgx servers +1 moreNVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use...5.3 Medium
- redhat.com wildfly-elytron, redhat jboss enterprise application platform, wildfly elytron +2 moreWildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator7.4 High
- tp-link archer c5, wr710n, archer c5 firmware +1 more +3 moreThe strcmp function in TP-Link routers, Archer C5 and WR710N-V1, used for checking credentials in httpd, is susceptible to a side-channel attack.7.5 High
- linux kernelA flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue...5.5 Medium
- arm cortex-a53 firmware, cortex-a55 firmware, cortex-a57 firmware +7 more +9 more** DISPUTED ** The AES instructions on the ARMv8 platform do not have an algorithm that is ...7.5 High
- talend administration centerIn Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature...5.3 Medium
- paysafe barzahlen payment module php sdkviafintech Barzahlen Payment Module PHP SDK Webhook.php verify timing discrepancy2.6 Low
- ziftr primecoinZiftr primecoin bitcoinrpc.cpp HTTPAuthorized timing discrepancy2.6 Low
- linuxcontainers lxclxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer...3.3 Low
- instedd nuntiumInSTEDD Nuntium geopoll_controller.rb timing discrepancy3.1 Low
- openshift osin, redhat openshift osin, openshift container platform +2 moreOpenShift OSIN CheckClientSecret timing discrepancy2.6 Low
- cocagne pysrpcocagne pysrp _ctsrp.py calculate_x information exposure2.6 Low
- snipeitapp snipe-itSnipe-IT allows attackers to check whether a user account exists5.3 Medium
- google androidIn placeCall of TelecomManager.java, there is a possible way to determine whether an app is...5.5 Medium
- arm mbed tls, fedoraproject fedora +1 moreAn issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access...5.3 Medium
- unknown clerk, clerk.io +1 moreClerk < 4.0.0 - Authentication Bypass and API Keys Disclosure7.5 High
- google androidIn revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine...3.3 Low
- google androidIn getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is...5.5 Medium
- google androidIn registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to...3.3 Low
- ipxeiPXE TLS tls.c tls_new_ciphertext information exposure2.6 Low
- nxp i.mx 6 firmware, i.mx 6dual firmware, i.mx 6duallite firmware +20 more +22 moreAn information-disclosure vulnerability exists on select NXP devices when configured in Serial...5.3 Medium
- Show moreLoading…