CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- elated-themes frappeFrappe: Unauthenticated User Enumeration via reset_password6.9 Medium
- No product listedAn issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive...7.5 High
- gofiber fiberFiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer5.3 Medium
- google chromeInappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a...5.3 Medium
- google chromeSide-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote...6.5 Medium
- google chromeSide-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871...6.5 Medium
- google chromeSide-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- google chromeSide-channel information leakage in Paint in Google Chrome prior to 150.0.7871.47 allowed a...6.5 Medium
- cap-go capgoCapgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPC6.9 Medium
- cap-go capgoCap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*6.9 Medium
- cap-go capgoCapgo - App Existence Oracle via GET /statistics/app/:app_id5.3 Medium
- artio book it\!, joomla! com booking component +1 moreJoomla com_booking 2.4.9 Information Disclosure via Account Enumeration8.7 High
- nocodbNocoDB: Plaintext Password Comparison in Shared Views6.9 Medium
- google chromeSide-channel information leakage in Paint in Google Chrome prior to 149.0.7827.53 allowed a...6.5 Medium
- google chromeSide-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53...6.5 Medium
- freescout-help-desk freescoutFreeScout: User Account Enumeration via Password Reset Response Differentiation5.3 Medium
- mauriceboe trekTime-based user enumeration in TREK authentication endpoint5.3 Medium
- industrial application software ias canias erpIndustrial Application Software IAS Canias ERP Login RMI doAction response discrepancy6.3 Medium
- inducer relateRELATE: Timing Attack Vulnerability in course/auth.py — check_sign_in_key()9.0 Critical
- weblateWeblate: Private Translation Enumeration via Screenshot API4.3 Medium
- wago smart designerWago: Vulnerability in Smart Designer Web-Application4.3 Medium
- enhancesoft osticketUser enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to...5.3 Medium
- sagedpw sage dpwThe login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid...3.7 Low
- discourseDiscourse has inferable private group membership or existence via exclude_groups parameter6.9 Medium
- parse-community parse-serverParse Server: Protected field change detection oracle via LiveQuery watch parameter6.3 Medium
- wolfsslCompiler-induced timing leak in sp_256_get_entry_256_9 on RISC-V2.1 Low
- wolfsslNon-constant time multiplication subroutine __muldi3 on RISC-V RV32I2.1 Low
- authlibAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle8.3 High
- mattermost, mattermost server +1 morePrivate channel enumeration via /mute slash command4.3 Medium
- projectsendprojectsend Auth.php response discrepancy6.3 Medium
- openclawOpenClaw File Existence tools.exec.safeBins information exposure4.8 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File Enumeration5.3 Medium
- gfi mailessentials, gfi software mailessentials ai +1 moreGFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File Enumeration5.3 Medium
- ethereum go-ethereum, go ethereum +1 moreGo Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake6.9 Medium
- kiteworks owncloudOwnCloud 8.1.8 - Username Disclosure5.3 Medium
- directus, directus @directus/api +1 moreDirectus Affected by User Enumeration via Password Reset Timing Attack5.3 Medium
- wekanWeKan < 8.19 Attachments Publication Information Disclosure5.3 Medium
- ci4-cms-erp ci4msCI4MS Vulnerable to User Email Enumeration via Password Reset Flow5.3 Medium
- filebrowserFile Browser vulnerable to Username Enumeration via Timing Attack in /api/login5.3 Medium
- zitadelZITADEL has a user enumeration vulnerability in Login UIs5.3 Medium
- rustcrypto cmov, utils +1 moreRustCrypto cmov: thumbv6m-none-eabi compiler emits non-constant time assembly when using cmovnz8.9 High
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM Vulnerable to Username Enumeration w/ Password Recovery5.3 Medium
- vanderbilt redcapREDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between...5.3 Medium
- hangzhou h3c technologies h3c ssl vpnH3C SSL VPN n/a Username Enumeration via Login Script Credential Verification6.9 Medium
- glpi-project glpiGLPI 9.5.7 Username Enumeration Vulnerability via Lost Password Endpoint6.9 Medium
- entrinsik informerThere is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows...2.8 Low
- jetbrains teamcityIn JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test2.7 Low
- wolfsslPotential non-constant time compiled code with Clang LLVM1.0 Low
- spenetix ag fusion digital signageSpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login Script6.9 Medium
- xiangshanXiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and...7.5 High
- Show moreLoading…