CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- nagvisLivestatus Injection in dynmaps6.9 Medium
- entrust nshield 5c firmware, nshield connect xc base firmware, nshield connect xc high firmware +2 more +4 moreEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a...7.2 High
- craws openatlasAn issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12...5.3 Medium
- wolfsslTiming Side-Channel in PSK Binder Verification2.3 Low
- wolfsslConstant Time Issue with Xtensa-based ESP32 and X225191.0 Low
- directusDirectus Vulnerable to Information Leakage in Existing Collections4.3 Medium
- owncloud guestsownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests...5.3 Medium
- cbk soft software hardware electronic computer systems industry and trade inc. envisionUser Enumeration in CBK Soft's enVision7.5 High
- ibm aspera faspexIBM Aspera Faspex information disclosure4.3 Medium
- jhumanj opnformJhumanJ OpnForm Forgotten Password email information exposure6.3 Medium
- joomla! project cmsJoomla! Core - [20250902] User-Enumeration in passkey authentication method5.3 Medium
- vmware nsxUsername enumeration vulnerability7.5 High
- wso2 identity server, identity server as key manager, open banking iam +2 moreUsername Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled3.7 Low
- google chromeSide-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote...9.1 Critical
- divvydrive information technologies inc. webTiming-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web4.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal exposes ERC which can lead to exploit the time response attack6.9 Medium
- debian linux, linux kernel, siemens simatic cn 4100 +2 moreipv6: sr: Fix MAC comparison to be constant-time9.8 Critical
- prestashopPresta Shop vulnerable to email enumeration3.7 Low
- google androidIn multiple locations, there is a possible way to access data displayed on the screen due to side...5.5 Medium
- zitadelZITADEL user enumeration vulnerability in login UI5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal User Enumeration Vulnerability via the Create Account Page6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Enumeration Discrepancy in Calendars5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Email Modification Vulnerability via Calendar Portlet5.3 Medium
- portabilis i-diarioPortabilis i-Diario Password Recovery Endpoint email observable response discrepancy6.3 Medium
- riscv-boom sonicboom, boom-core risvc-boom +1 moreriscv-boom SonicBOOM L1 Data Cache timing discrepancy2.0 Low
- eg4 electronics 12000xp, 12kpv, 18kpv +4 more +6 moreEG4 Electronics EG4 Inverters Observable Discrepancy6.9 Medium
- openbaoOpenBao: Timing Side-Channel in Userpass Auth Method3.7 Low
- hashicorp vault, vault enterprise +1 moreTiming Side-Channel in Vault’s Userpass Auth Method3.7 Low
- otrs ag otrsPossible user enumeration5.3 Medium
- egroupwareAn issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists...5.3 Medium
- parisneo parisneo/lollmsTiming Attack Vulnerability in parisneo/lollms7.5 High
- ergon informatik ag airlock iamTiming difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2...6.9 Medium
- endress meac300-fnade4 firmware, endress+hauser meac300-fnade4 +1 moreCVE-2025-274515.3 Medium
- code-projects daily expense manager, daily expense manager expense manager +1 moreUser enumeration vulnerability in Daily Expense Manager8.7 High
- kanboardKanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass5.3 Medium
- vllmvLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel2.6 Low
- mauticUser name enumeration possible due to response time difference on password reset form5.3 Medium
- ubtech freepassUBtech – CWE-203: Observable Discrepancy4.3 Medium
- tridium niagara, niagara enterprise security, niagara framework +2 moreObservable Response Discrepancy5.3 Medium
screenAlpaquitaScreen 5.0.0 and older versions allow file existence tests when installed setuid-root2.0 Low- keystonejs keystoneKeystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields3.1 Low
- franka robotics emika robotEnumeration of valid user names5.3 Medium
- espocrmEspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting Function3.1 Low
- perforce helix almPotential Username Enumeration in Helix ALM6.3 Medium
- axis os, os 2024 +1 moreDuring an annual penetration test conducted on behalf of Axis Communications, Truesec discovered...4.3 Medium
- zitadelZitadel allows User Enumeration by loginname attribute normalization5.3 Medium
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure4.3 Medium
- fractal string::compare::constanttime, string\ +1 moreString::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string7.5 High
- intevation openslidesAn issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/...5.3 Medium
- codesys runtime toolkitCODESYS Control V3 - OPC UA Server Authentication bypass7.5 High
- Show moreLoading…