CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- sourcebans-pp project sourcebans-ppAn issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information...7.5 High
- mudler localai, mudler/localai +1 moreTiming Attack in mudler/localai7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreVideo frames could have been leaked between origins in some situations. This vulnerability...6.5 Medium
- icewhaletech zimaosZimaOS vulnerable to Username Enumeration via API Responses5.3 Medium
- botan project botanBotan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent...5.9 Medium
- botan project botanBotan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent...5.9 Medium
- reolink duo 2 wifi camera firmwareAccounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware...5.3 Medium
- linux, linux kernel +1 moreicmp: change the order of rate limits9.4 Critical
- oracle database serverVulnerability in the Java VM component of Oracle Database Server. Supported versions that are...3.1 Low
- oracle database serverVulnerability in the Oracle Database Core component of Oracle Database Server. Supported...4.3 Medium
- oracle corporation java se, oracle jdk, jre +2 moreVulnerability in Oracle Java SE (component: Hotspot). Supported versions that are affected are...3.7 Low
- oracle graalvm, graalvm for jdk, jdk +2 more +4 moreVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...3.7 Low
- oracle enterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business...4.3 Medium
- gradio-app gradioNon-constant-time comparison when comparing hashes in Gradio2.3 Low
i2pUbuntui2p before 2.3.0 (Java) allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden...3.7 Low- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 21h2 +13 more +15 moreWindows Cryptographic Information Disclosure Vulnerability5.6 Medium
- netadmin iamNetadmin Software NetAdmin IAM HTTP POST Request ReturnUserQuestionsFilled information exposure6.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreBy checking the result of calls to `window.open` with specifically set protocol handlers, an...5.3 Medium
- gotenna atak plugin, pro atak plugin +1 moregoTenna Pro ATAK Plugin Observable Response Discrepancy5.3 Medium
- emlog pro, gotenna pro app +1 moreObservable Response Discrepancy in goTenna Pro5.3 Medium
- netcat, netcat cms, content management system +2 moreNetcat CMS: user enumeration6.9 Medium
intel-microcodeDebian,intel-ucodeAlpaquita,microcodeMageia +2 more +4 moreObservable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user...6.8 Medium- ordat foss-online, ordat.erp +1 moreUser enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine...5.3 Medium
- loway queuemetricsLoway - CWE-204: Observable Response Discrepancy5.3 Medium
- ethyca fidesFides Webserver Authentication Timing-Based Username Enumeration Vulnerability5.3 Medium
- fsas technologies inc. ipcom ex2 series, ipcom ve2 series, fujitsu ipcom ex2 dc 3200 firmware +18 more +20 moreObservable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401,...7.5 High
- yubico security key c nfc by yubico firmware, security key nfc by yubico firmware, yubihsm 2 fips firmware +15 more +17 moreYubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware...4.2 Medium
- djangoproject djangoDjango allows enumeration of user e-mail addresses5.3 Medium
- wolfssl, wolfssl wolfcrypt +1 moreAES T-Table sub-cache-line leakage4.1 Medium
- wolfsslECDSA nonce bias caused by truncation4.1 Medium
- zitadelZitadel has an "Ignoring unknown usernames" vulnerability5.3 Medium
- matrix tafnit v8, matrix-globalservices tafnit +1 moreMatrix Tafnit v8 - CWE-204: Observable Response Discrepancy5.3 Medium
- veilidIn veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that...5.3 Medium
- mattermostTiming attack during remote cluster token comparison when shared channels are enabled8.1 High
- twilio authy, authy 2-factor authentication, authy authenticator +2 moreIn the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an...5.3 Medium
- splunk, splunk cloud platform, enterprise +2 moreInformation Disclosure of user names5.3 Medium
- ibm storage defender - resiliency service, storage defender resiliency service +1 moreIBM Storage Defender information disclosure5.3 Medium
- linux, linux kernel +1 moredma-buf: heaps: Fix potential spectre v1 gadget5.5 Medium
- spa-cart, spa-cart spa-cartcms +1 morespa-cartcms Username login observable behavioral discrepancy6.3 Medium
- dalek curve25519-dalekcurve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`2.9 Low
- nasirkhan laravel starternasirkhan Laravel Starter Password Reset forgot-password observable response discrepancy6.3 Medium
- guoxinled synthesis image systemShenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the...5.3 Medium
- ibm db2 for i, i +1 moreIBM i information disclosure3.3 Low
- mozilla firefoxA website was able to detect when a user took a screenshot of a page using the built-in...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreBy monitoring the time certain operations take, an attacker could have guessed which external...4.3 Medium
- pq-crystals kyberThe Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with...7.5 High
- ibm iIBM i information disclosure5.3 Medium
- gaizhenbiao chuanhuchatgpt, gaizhenbiao/chuanhuchatgpt +1 moreTiming Attack Vulnerability in gaizhenbiao/chuanhuchatgpt7.5 High
s2n-tlscrates.ios2n-tls has a potentially observable differences in RSA premaster secret handlingNo score- google androidthere is a possible information disclosure due to side channel information disclosure. This could...5.5 Medium
- Show moreLoading…