CWE-204: Observable Response Discrepancy
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
A kind of CWE-203 Observable Discrepancy.
From the CWE List. © The MITRE Corporation.
Newest
- budibaseBudibase: Account Enumeration via Login Lockout Response Differential5.3 Medium
- neutrinolabs xrdpXRDP is vulnerable to a server timing attack, leading to user enumeration5.3 Medium
- hcl software aftermarket epcHCL Aftermarket EPC is vulnerable to attack since It was found that a malicious actor can use...5.3 Medium
- cyrusimap cyrus imapAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross...4.3 Medium
- sri mojoliciousMojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle9.1 Critical
- sap se hana extended application services classic model (user self service)Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)3.7 Low
- rejetto hfsRejetto HFS < 3.2.1 Username Enumeration via Login Response Differences6.9 Medium
web-auth/webauthn-libPackagistWebauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection2.9 Low- erlang otp, erlang\/otp, erlang\/ssh +2 moreSFTP REALPATH path-existence oracle allowing filesystem enumeration outside configured root2.3 Low
- mycomplianceoffice mco, mycomplianceoffice +1 moreUser Enumeration in MCO6.9 Medium
pterodactyl/panelPackagistPterodactyl Panel: Client email change endpoint allows enumeration of accounts in system5.5 Medium- tryghost ghostGhost: Member existence leak via magic link sign-in response5.3 Medium
- vantage6Vantage6: Set admin user and password from environment or configuration6.9 Medium
- fossbillingFOSSBilling's password reset confirmation endpoint lacks rate limiting6.3 Medium
- freescout-help-desk freescoutFreeScout: User Account Enumeration via Password Reset Response Differentiation5.3 Medium
- userspiceuserSpice 4.3.24 Username Enumeration via existingUsernameCheck.php9.3 Critical
- wwbn avideoAVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration5.3 Medium
- wso2 email otp authenticator, identity server, identity server as key manager +2 more +4 moreUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery5.3 Medium
- industrial application software ias canias erpIndustrial Application Software IAS Canias ERP Login RMI doAction response discrepancy6.3 Medium
lemmy_apicrates.ioLemmy resend-verification endpoint exposes registered email addresses to unauthenticated users5.5 Medium- statamic cmsStatamic: Email enumeration via forgot password endpoint5.3 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Observable Response Discrepancy Vulnerability5.3 Medium
- oracle mysql, oracle corporation mysql shell +1 moreVulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). ...5.0 Medium
- openaev-platform openaevOpenAEV Vulnerable to Username/Email Enumeration Through Differential HTTP Responses in Password Reset API5.3 Medium
- churchcrm crmChurchCRM: Username Enumeration via Differential Response in Public Login API5.3 Medium
- sap human capital management, sap se human capital management for sap s/4hana +1 moreInformation Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA6.5 Medium
- sonicwall sma1000, sma6200 firmware, sma6210 firmware +3 more +5 moreAn observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances...7.2 High
- saleorSaleor has a user enumeration vulnerability due to different error messages5.3 Medium
- sagedpw sage dpwThe login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid...4.7 Medium
- sagedpw sage dpwThe login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid...3.7 Low
- eset, spol. s.r.o eset protect (on-prem)User enumeration in ESET Protect (on-prem)5.3 Medium
- wwbn avideoAVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint5.3 Medium
- minioMinIO: LDAP login brute-force via user enumeration and missing rate limit9.1 Critical
- parse-community parse-serverParse Server: Email verification resend page leaks user existence6.3 Medium
- chamilo lms, chamilo-lms +1 moreChamilo LMS: User enumeration vulnerability via response6.3 Medium
- raythaUser enumeration in Raytha CMS6.9 Medium
- ibm aspera consoleIBM Aspera Console Information Disclosure5.3 Medium
- opentext verticaUsername Enumeration Observable Response Discrepancy vulnerability has been discovered in OpenText™ Vertica.5.1 Medium
- checkmkUnauthenticated Host Enumeration via Observable Response Discrepancy on Deploy Agent Endpoint6.3 Medium
- checkmkAuthenticated Host Enumeration via Observable Response Discrepancy on Agent Register Existing Endpoint5.3 Medium
- projectsendprojectsend Auth.php response discrepancy6.3 Medium
- runzero platform, shopware, opnsense core +2 moreShopware has user enumeration via distinct error codes on Store API login endpoint5.3 Medium
- parse-community parse-serverParse Server has user enumeration via email verification endpoint6.3 Medium
- nocodbNocoDB: User Enumeration via Password Reset Endpoint2.7 Low
- difyDify has a user enumeration issue5.5 Medium
- cern rucioRucio WebUI has Username Enumeration via Login Error Message5.3 Medium
- piwigoPiwigo Vulnerable to User Enumeration via Password Reset Endpoint5.5 Medium
- static-web-server static web server, static-web-server +1 moreStatic Web Server: Timing-Based Username Enumeration in Basic Authentication5.3 Medium
- formalmsA user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery...5.3 Medium
- dokuwikiDokuwiki 2018-04-22b - Username Enumeration6.9 Medium
- Show moreLoading…