CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- davidosipov postquantum-feldman-vssPost-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations5.8 Medium
- ibm common cryptographic architecture, 4769 developers toolkit +1 moreIBM Common Cryptographic Architecture information disclosure3.7 Low
- printerlogic vasion print, virtual appliance +1 moreVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923...9.8 Critical
- dpgaspar flask-appbuilderObservable Response Discrepancy in flask-appbuilder3.7 Low
- No product listedDraytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860...7.5 High
- siemens simatic drive controller cpu 1504d tf, simatic drive controller cpu 1507d tf, simatic et 200sp cpu 1510sp f-1 pn +98 more +100 moreThe login functionality of the web server in affected devices does not normalize the response...6.9 Medium
- ibm sterling b2b integratorIBM Sterling B2B Integrator information disclosure4.3 Medium
- broadcom symantec privileged access managementA specific authentication strategy allows to learn ids of PAM users associated with certain...5.3 Medium
- ibm aspera faspexIBM Aspera Faspex information disclosure5.3 Medium
- arm c1-premium, c1-premium firmware, c1-pro +15 more +17 moreAn unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents...5.1 Medium
- apple macosThis issue was addressed with improved redaction of sensitive information. This issue is fixed in...9.8 Critical
- ibm sterling file gatewayIBM Sterling File Gateway information disclosure4.3 Medium
- ibm control centerIBM Control Center information disclosure5.3 Medium
- arm cortex-a57, cortex-a72, cortex-a73 +5 more +7 moreSpectre-BSE5.1 Medium
- oracle jd edwards enterpriseone toolsVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web...7.5 High
- umbraco cms, umbraco-cms +1 moreUmbraco CMS Vulnerable to User Enumeration Feasible Based On Management API Timing and Response Codes5.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 moreWindows Cryptographic Information Disclosure Vulnerability5.6 Medium
- fortinet forticlientems, fortisoar +1 moreAn observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through...4.9 Medium
- hcl software dryice myxalyticsHCL MyXalytics is affected by username enumeration vulnerability3.7 Low
- langhsu mblog blog system, mtons mblog +1 morelanghsu Mblog Blog System login observable response discrepancy6.3 Medium
- No product listedAn access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows...7.5 High
- google androidIn multiple functions of ConnectivityService.java, there is a possible way for a Wi-Fi AP to...7.5 High
- google androidIn reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an...5.5 Medium
- google androidIn build_read_multi_rsp of gatt_sr.cc, there is a possible denial of service due to a logic error...6.5 Medium
- google androidIn multiple locations, there is a possible way to obtain any system permission due to a logic...7.8 High
- antabot white-jotterAntabot White-Jotter login observable response discrepancy6.3 Medium
- gnu grub2GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp...5.3 Medium
- No product listedAn issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18,...5.3 Medium
- honor magic os, magicos +1 moreSome Honor products are affected by information leak vulnerability, successful exploitation could...3.3 Low
- honor magic os, magicos +1 moreSome Honor products are affected by incorrect privilege assignment vulnerability, successful...3.3 Low
- honor magic os, magicos +1 moreSome Honor products are affected by information leak vulnerability, successful exploitation could...5.5 Medium
- honor magic os, magicos +1 moreSome Honor products are affected by information leak vulnerability, successful exploitation could...5.5 Medium
- honor magic os, magicos +1 moreSome Honor products are affected by information leak vulnerability, successful exploitation could...6.2 Medium
- honor magic os, magicos +1 moreSome Honor products are affected by information leak vulnerability, successful exploitation could...4.0 Medium
- honor magic os, magicos +1 moreSome Honor products are affected by information leak vulnerability, successful exploitation could...6.2 Medium
- honor magic os, magicos +1 moreSome Honor products are affected by information leak vulnerability, successful exploitation could...6.2 Medium
- honor magicosInformation Leak Vulnerability in Honor Product3.3 Low
- miniorange page restriction, cyberlord92 page and post restriction +1 morePage Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3 Medium
- funnyzpc mee-adminfunnyzpc Mee-Admin Login login observable response discrepancy6.3 Medium
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS...5.5 Medium
- dependencytrack dependency-trackDependency-Track allows enumeration of managed users via /api/v1/user/login endpoint5.3 Medium
- google androidIn the LG LAF component, there is a special command that allowed modification of certain...7.5 High
- cisco unified computing system (managed), unified computing system +1 moreCisco Integrated Management Controller Username Enumeration Vulnerability5.3 Medium
qatengineopenSUSE,qatlibopenSUSE,qatzipSUSE +2 moreObservable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may...8.2 High- mozilla thunderbirdUsing remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This...4.3 Medium
- No product listedCertain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not...5.5 Medium
- No product listedCertain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not...5.5 Medium
- combodo itopUsers enumeration allowed through Rest API in Combodo iTop7.5 High
- linux, linux kernel +1 morex86: fix user address masking non-canonical speculation issue5.5 Medium
- ibm txseries for multiplatformsIBM TXSeries for Multiplatforms information disclosure5.3 Medium
- Show moreLoading…