CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- ruijie rg-eg105g firmware, rg-eg105g v2 firmware, rg-eg210g-p firmware +4 more +6 moreAn issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hijack TCP sessions which could lead to a denial of service.6.5 Medium
- No product listedAn issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to a denial of service, impersonating the client to the server…7.3 High
- dell bsafe crypto-c micro edition, bsafe micro edition suite, bsafe crypto-c-micro-edition +1 more +3 moreDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite,...5.1 Medium
- linux, linux kernel +1 morex86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer7.1 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +22 more +24 moreWindows MSHTML Platform Security Feature Bypass Vulnerability8.8 High
- apple ipados, ios and ipados, ipad os +1 more +3 moreA privacy issue was addressed by moving sensitive data to a more secure location. This issue is...3.3 Low
- bouncycastle bouncy castle for java, netapp active iq unified manager, bluexp +2 more +4 moreBouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")5.9 Medium
- ibm aspera orchestratorIBM Aspera Orchestrator information disclosure5.3 Medium
- ibm cognos controllerIBM Cognos Controller information disclosure5.3 Medium
- logpoint, logpoint siem +1 moreIn Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly...5.3 Medium
mdanter/eccPackagistPHPECC vulnerable to multiple cryptographic side-channel attacks9.1 Critical- redhat openssl, red hat enterprise linux 6, enterprise linux 7 +2 more +4 morePerl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)5.9 Medium
- 1panel-dev 1panel1Panel's password verification is suspected to have a timing attack vulnerability3.9 Low
- microsoft windows server 2016, windows server 2016 (server core installation), windows server 2019 +4 more +6 moreWindows DNS Server Remote Code Execution Vulnerability7.2 High
- red hat enterprise linux 8, enterprise linux 9 +1 moreRust-openssl: timing based side-channel can lead to a bleichenbacher style attack5.9 Medium
- cdexApplication users enumeration in CDeX6.3 Medium
- umbraco umbraco-cms, cms +1 moreUmbraco possible user enumeration vulnerability3.7 Low
- delinea secret serverUser enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This...5.3 Medium
- hp inc. pc bios, hp inc business desktop pcs, business notebook pcs +2 more +4 moreA potential security vulnerability has been reported in the system BIOS of certain HP PC products...8.2 High
- icewhale casaos-userserviceCasaOS Username Enumeration6.2 Medium
- ibm cics tx advanced, cics tx +1 moreIBM CICS TX information disclosure5.3 Medium
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 morePrevent timing attack for single-user password check7.1 High
- liveboxcloud vdeskAn issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response...7.5 High
- ibm common licensingIBM Common Licensing information disclosure4.0 Medium
- liferay dxp, portal, ibexa digital experience platform +1 more +3 moreLiferay Portal and Liferay DXP User Enumeration Vulnerability5.3 Medium
- hp inc. certain hp desktop pc products, hp elite mini 600 g9 firmware, elite mini 800 g9 firmware +35 more +37 morePotential vulnerabilities have been identified in certain HP Desktop PC products using the HP...6.4 Medium
- rhonabwy project rhonabwy, debian linux +1 moreIn Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable...9.8 Critical
- wolfsslMarvin Attack vulnerability in SP Math All RSA5.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal allows attackers to discover the existence of sites5.3 Medium
- zihanggao php-jwtphp-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it...9.8 Critical
- glitchedpolygons l8w8jwtl8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it...9.8 Critical
- libjwt, bencollins jwt c library, debian linux +2 morelibjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it...9.8 Critical
- apache pulsarApache Pulsar: Timing attack in SASL token signature verification7.4 High
- m2crypto project m2crypto, red hat enterprise linux 6, enterprise linux 7 +7 more +9 moreM2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-256577.5 High
- cryptlibCryptlib: rsa key exchange ciphersuites in tls vulnerable to marvin attack5.9 Medium
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +5 more +7 moreKernel: marvin vulnerability side-channel leakage in the rsa decryption operation6.5 Medium
- dell bsafe micro edition suite, bsafe micro-edition-suite +1 moreDell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy...5.9 Medium
- opensc project opensc, red hat enterprise linux 7, enterprise linux 8 +11 more +13 moreOpensc: side-channel leaks while stripping encryption pkcs#1 padding5.6 Medium
- opencryptoki project opencryptoki, red hat enterprise linux 6, enterprise linux 7 +6 more +8 moreOpencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin)5.9 Medium
- arm mbed tlsAn issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing...5.5 Medium
- latchset pkcs11-provider, fedora +1 morePkcs11-provider: side-channel proofing pkcs#1 1.5 paths8.1 High
- vantage6vantage6 username timing attack3.7 Low
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreKernel: max page sharing of kernel samepage merging (ksm) may cause memory deduplication5.3 Medium
- seopanel seo panelAn user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user...5.3 Medium
- apple ipados, macos, tvos +3 more +5 moreA timing side-channel issue was addressed with improvements to constant-time computation in...5.9 Medium
- tlsfuzzer ecdsa, python-ecdsa +1 morepython-ecdsa vulnerable to Minerva attack on P-2567.4 High
- unix4lyfe darkhttpddarkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which...9.8 Critical
- kjur jsrsasignMarvin Attack of RSA and RSAOAEP decryption in jsrsasign7.5 High
- gnu gnutls, fedoraproject fedora, red hat enterprise linux 6 +10 more +12 moreGnutls: incomplete fix for cve-2023-59817.5 High
- pycryptodome, pycryptodome pycryptodomex +1 morePyCryptodome and pycryptodomex side-channel leakage for OAEP decryption5.9 Medium
- Show moreLoading…