CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- mozilla firefoxUsing iterative requests an attacker was able to learn the size of an opaque response, as well as...5.3 Medium
- texas instruments omap, ti omap l138 firmware +1 moreSK_LOAD timing side channel during AES module decryption in Texas Instruments OMAP L1384.4 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreNSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack...6.5 Medium
- mozilla nssThe NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting...6.5 Medium
- mendix forgot password, siemens mendix forgot password (mendix 10 compatible), mendix forgot password (mendix 7 compatible) +2 more +4 moreA vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All...5.3 Medium
- phpjabbers appointment schedulerUser enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during...7.5 High
- economizzerEconomizzer user enumeration vulnerability5.3 Medium
- amd ryzen 5 7600x, ryzen 7 4800u, apple m1 mac mini +14 more +16 morePVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software...5.3 Medium
- nvidia dgx a100 bmc, dgx h100 bmc, dgx h100 firmware +2 moreNVIDIA DGX H100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated...8.0 High
- fujitsu arconte áurea, arconte aurea +1 moreUser enumeration vulnerability in Fujitsu Arconte Áurea5.3 Medium
- piccolo-orm piccoloPiccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration5.3 Medium
- alfnru password recovery plugin, password recovery project recovery +1 moreUser enumeration vulnerability in Roundcube Password Recovery Plugin5.3 Medium
- goauthentik authentikUsername enumeration attack in goauthentik5.3 Medium
- phpjabbers callback widgetUser enumeration is found in PHPJabbers Callback Widget v1.0. This issue occurs during password...9.8 Critical
- ibm cics tx advanced, cics tx standard, cics tx +2 more +4 moreIBM GSKit-Crypto information disclosure7.5 High
- unknown change wp admin login, wpexperts all in one login +1 moreChange WP Admin < 1.1.4 - Secret Login Page Disclosure7.5 High
- oppiaTiming Attack Reveals CSRF Tokens in oppia5.3 Medium
- jenkins tuleap authentication, jenkins project tuleap authentication plugin +1 moreJenkins Tuleap Authentication Plugin non-constant time token comparison5.9 Medium
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed by restricting options offered on a locked device. This issue is fixed...2.4 Low
- ryzen™ pro 5000 series desktop processors, amd 1st gen amd epyc™ processors, 2nd gen amd epyc™ processors +178 more +180 moreA side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the...4.7 Medium
- debian linux, intel celeron 5205u firmware, celeron 5305u firmware +531 more +533 moreImportant: kernel security, bug fix, and enhancement update6.5 Medium
- amd processors, * +1 moreSoftware based Power Side Channel on AMD CPUs4.7 Medium
- hashicorp vault, vault enterprise +1 moreVault's LDAP Auth Method Allows for User Enumeration5.3 Medium
- tadiran telecom aeonix, tadirantele aeonix +1 moreTadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy5.3 Medium
- 42gears suremdm, onpremise suremdm solution suremdm onpremise +1 moreBypassing CAPTCHA & Enumerating Usernames via Password Reset Page4.8 Medium
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreKernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user sp…7.0 High
- totolink cp300\+, cp300\+ firmware +1 moreTOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem...7.5 High
- amd 1st gen amd epyc™ processors, 2nd gen amd epyc™ processors, 3rd gen amd epyc™ processors +89 more +91 moreA potential power side-channel vulnerability in some AMD processors may allow an authenticated...6.5 Medium
- sick ag icr890-4, sick icr890-4 firmware +1 moreObservable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify...5.3 Medium
- rotem dynamics crm, rotem-dynamics rotem crm +1 moreRotem Dynamics Rotem CRM OTP URI Interface information exposure5.3 Medium
- moxa tn-5900, tn-5900 series, tn-5900 firmware +2 moreTN-5900 Series User Enumeration Vulnerability5.3 Medium
- unknown protect wp adminProtect WP Admin < 4.0 - Unauthenticated Protection Bypass6.1 Medium
- mediawikiAn issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through...5.3 Medium
- checkmkUser-enumeration in RestAPI4.3 Medium
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed with improved data protection. This issue is fixed in iOS 16.1 and...5.5 Medium
- ujcmsAn issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the...7.5 High
- hp inc. enterprise laserjet and hp laserjet managed printers, hp futuresmart 5 +1 moreCertain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to...7.5 High
- ami megarac sp-x, megarac spx +1 moreA vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username5.3 Medium
- emoncmsemoncms v11 and later was discovered to contain an information disclosure vulnerability which...5.3 Medium
- bluetooth core specificationBluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device...4.3 Medium
- ibm gskit, http server +1 moreIBM GSKit information disclosure7.5 High
- macro-video v380 proMacrovideo v380pro v1.4.97 shares the device id and password when sharing the device.7.5 High
- avaya ix workforce engagementAvaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response Discrepancy5.3 Medium
- open-xchange ox app suiteOX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution...4.3 Medium
- tibco ebx add-onsTIBCO EBX® Add-ons Path Traversal7.7 High
- saleorNon-constant time HMAC comparison in Adyen plugin in Saleor4.8 Medium
- hcl domino appdev packHCL Domino AppDev Pack is susceptible to a User Account Enumeration vulnerability5.3 Medium
- ginuerzh gost, go simple tunnel project simple tunnel +1 moreginuerzh/gost vulnerable to Timing Attack5.9 Medium
- snap one ovrc cloud, snapone orvc +1 moreWhen supplied with a random MAC address, Snap One OvrC cloud servers will return...5.3 Medium
- huawei emui, harmonyos +1 moreThe multimedia video module has a vulnerability in data processing.Successful exploitation of...7.5 High
- Show moreLoading…