CWE-204: Observable Response Discrepancy
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
A kind of CWE-203 Observable Discrepancy.
From the CWE List. © The MITRE Corporation.
Newest
- gunet open eclass platform, openeclass +1 moreOpen eClass is Vulnerable to Username Enumeration via Login Response Discrepancies5.3 Medium
- ci4-cms-erp ci4msCI4MS Vulnerable to User Email Enumeration via Password Reset Flow5.3 Medium
- discord websocket api serviceDiscord through 2026-01-16 allows gathering information about whether a user's client state is...4.3 Medium
- zitadelZITADEL has a user enumeration vulnerability in Login UIs5.3 Medium
- mintplexlabs anythingllm, mintplex-labs anything-llm +1 moreAnythingLLM Vulnerable to Username Enumeration w/ Password Recovery5.3 Medium
- giteaGitea's /api/v1/user endpoint has different responses for failed authentication depending on whether a username exists5.3 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has plaintext password return in response6.9 Medium
- pegasystems pega infinityPega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration where during user authentication process, a difference in response time could allow a remote unauthenticated use…5.3 Medium
- joinmastodon mastodonMastodon Error Handling Discrepancy Enables Private Status Existence Enumeration3.7 Low
- intellichoice eforce software suiteIntelliChoice eFORCE Software Suite Username Enumeration6.9 Medium
- siemens gridscale x prepayA vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected...6.9 Medium
- medtronic carelink networkMedtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for...5.3 Medium
- difuse kalmiaKalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication...5.3 Medium
- getgrav grav, grav-plugin-admin +1 moreGrav Admin Plugin vulnerable to User Enumeration & Email Disclosure6.5 Medium
- jcd windu cms, windu cms +1 moreUser enumeration in Windu CMS6.9 Medium
- omnissa workspace one uemOmnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious...5.3 Medium
- flyfrontier frontier airlines, frontier airlines flyfrontier.com +1 moreFrontier Airlines publicly available email address validation6.9 Medium
- tibbo systems aggregate network managerTibbo AggreGate Network Manager < 6.40.05 Login Functionality User Enumeration6.9 Medium
- d-link nuclias connectD-Link Nuclias Connect <= v1.3.1.4 Forgot Password Account Enumeration6.9 Medium
- d-link nuclias connectD-Link Nuclias Connect <= v1.3.1.4 Login Account Enumeration6.9 Medium
- icinga, icinga icinga2 +1 moreIcinga 2 API users could access restricted values in filter expressions7.1 High
- icinga db web, icingadb-web +1 moreIcinga DB Web hidden/protected custom variables are prone to filter enumeration5.3 Medium
- sap se financial service claims managementUser Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management4.3 Medium
- sick baggage analytics, enterprise analytics, logistic diagnostic analytics +2 more +4 moreUser Enumeration by excessive error output5.3 Medium
- trivisionsecurity trivision nc-227wf firmwareTrivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username...5.3 Medium
- saleorSaleor has user enumeration vulnerability due to different error messages5.3 Medium
- mauticUser Enumeration via Response Timing5.9 Medium
- silverpeasSilverpeas Core Username Enumeration Vulnerability6.5 Medium
- portabilis i-diarioPortabilis i-Diario Password Recovery Endpoint email observable response discrepancy6.3 Medium
- emby mediabrowserCWE-204: Observable Response Discrepancy7.5 High
- opexus foiaxpress public access link (pal), opexustech foiaxpress public access link +1 moreOPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration6.9 Medium
- enalean tuleapTuleap vulnerable to user enumeration via the lost password form5.3 Medium
- psu haxiam, haxtheweb issues +1 moreHAXiam allows for User Enumeration4.3 Medium
- endress meac300-fnade4 firmware, endress+hauser meac300-fnade4 +1 moreCVE-2025-274515.3 Medium
- mb connect line mbconnect24, mymbconnect24, helmholz myrex24 +1 more +3 moreMB connect line: Observable response discrepancy in mbCONNECT24/mymbCONNECT247.5 High
- sinotrack iot pc platformSinoTrack GPS Receiver Weak Authentication8.8 High
- sick field analyticsUser enumeration5.3 Medium
- ibm security verify access, security verify access docker +1 moreIBM Security Verify Access information disclosure5.3 Medium
- mauticUser name enumeration possible due to response time difference on password reset form5.3 Medium
- tridium niagara, niagara enterprise security, niagara framework +2 moreObservable Response Discrepancy5.3 Medium
- schweitzer engineering laboratories sel-5056 software-defined network flow controllerObservable Response Discrepancy3.7 Low
- siemens polarion v2310, polarion v2404, polarion alm +2 moreA vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All...6.9 Medium
- umbraco umbraco-cms, cms +1 moreUmbraco Makes User Enumeration Feasible Based on Timing of Login Response5.3 Medium
- bosch rexroth ag ctrlx os - device adminA vulnerability in the login functionality of the web application of ctrlX OS allows a remote...5.3 Medium
silverstripe/frameworkPackagistSilverstripe Framework user enumeration via timing attack on login and password reset forms5.3 Medium- shopwareShopware 6 allows attackers to check for registered accounts through the store-api5.5 Medium
- siemens mendix runtime v10, mendix runtime v10.12, mendix runtime v10.18 +3 more +5 moreA vulnerability has been identified in Mendix Runtime V10 (All versions < V10.21.0), Mendix...6.9 Medium
- ibm txseries for multiplatformsIBM TXSeries for Multiplatforms information disclosure5.3 Medium
- zitadelZitadel allows User Enumeration by loginname attribute normalization5.3 Medium
- fermax meetmeUser enumeration vulnerability in MeetMe products6.9 Medium
- Show moreLoading…