CWE-203: Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Also known as Side Channel Attack.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeObservable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker...5.3 Medium
- wso2 identity serverUsername Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery3.7 Low
- wso2 api control plane, api manager, carbon identity application authentication framework +7 more +9 moreUsername Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery5.3 Medium
- bitnami sealed-secretsSealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints4.2 Medium
- google chromeObservable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...6.5 Medium
- google chromeObservable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote...6.5 Medium
- google chromeObservable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote...4.3 Medium
- google chromeObservable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...6.5 Medium
- google chromeObservable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote...5.3 Medium
- google chromeObservable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed...5.3 Medium
- google chromeObservable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote...4.3 Medium
- google chromeObservable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote...3.1 Low
- google chromeObservable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote...6.5 Medium
- macropay-solutions maravel-frameworkMaravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing6.9 Medium
- google androidIn multiple locations, there is a possible permission bypass due to side channel information...6.2 Medium
- adobe dimensionWatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate Limiting6.3 Medium
- seres software sywebUser Enumeration in Seres Software's syWEB5.3 Medium
- No product listedUser enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an...5.3 Medium
- weblateorg weblateObservable object existence disclosure in private Weblate projects via globally scoped object lookups4.3 Medium
- google chromeObservable discrepancy in Glic in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...5.3 Medium
- google chromeObservable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65...2.9 Low
- google chromeObservable discrepancy in HTML in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...5.3 Medium
- google chromeObservable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...5.3 Medium
- google chromeObservable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65...2.9 Low
- google chromeObservable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65 allowed a...6.5 Medium
- google chromeObservable discrepancy in Network in Google Chrome prior to 152.0.7977.65 allowed a remote...5.3 Medium
- google chromeObservable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...4.3 Medium
- google chromeObservable discrepancy in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote...5.3 Medium
- getgrav grav-plugin-loginGrav Login Plugin before 3.9.1 Email Enumeration via Registration9.3 Critical
- coderCoder before 2.34.2 User Enumeration via Login Placeholder Hash6.3 Medium
- mozilla firefox, thunderbird +1 moreSide-channel in the Web Audio component9.1 Critical
- mozilla firefox, thunderbird +1 moreInformation disclosure due to side-channel in the Storage: Cache API component7.5 High
- zabbixHost PSK extraction in Zabbix API6.0 Medium
- zabbixFrontend plaintext macro value enumeration via the validatate.api.exists action5.3 Medium
- unspecified automadautomad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy6.3 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via authFilePublishAccess6.9 Medium
- elastic kibanaObservable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API Keys7.1 High
- priority portal generator addon to priority erp (developed by soft solutions)Priority - CWE-203: Observable Discrepancy5.3 Medium
- wso2 api manager, identity server, identity server as key manager +2 more +4 moreUsername Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery3.7 Low
- bouncycastle bcpg-fips, bouncy castle for java lts, legion of the bouncy castle inc. bc-fja +2 more +4 moreOpenPGP CFB quick-check oracle active on symmetric/session-key paths8.7 High
- xlight ftp server, xlightftpd xlight ftp server +1 moreXlight FTP Server < 3.9.5 Information Disclosure via USER Command6.9 Medium
- apple ipados, macos, safari +5 more +7 moreThis issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and...8.1 High
- budibaseBudibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile5.1 Medium
- dompdfDompdf: File existence oracle via font-face stylesheet declaration2.3 Low
- oracle siebel crm, oracle corporation siebel crm deployment +1 moreVulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application...2.6 Low
- electricsql electric postgres syncElectric Postgres Sync Excluded-Column Value Inference via Subset Where Clauses5.3 Medium
- gitea open source git serverCross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API2.7 Low
- thiagopena djangosigedjangoSIGE 1.10 User Enumeration via ForgotPasswordView6.9 Medium
- cap-go capgoCapgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPC8.7 High
- cap-go capgoCap-go - App Existence Oracle via Unauthenticated transfer_app RPC6.9 Medium
- Show moreLoading…