CWE-208: Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
A kind of CWE-203 Observable Discrepancy.
From the CWE List. © The MITRE Corporation.
Newest
- jopenid project jopenidmichaelliao jopenid OpenIdManager.java getAuthentication timing discrepancy2.6 Low
- nvidia dgx a100 firmware, dgx servers +1 moreNVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use...5.3 Medium
- redhat.com wildfly-elytron, redhat jboss enterprise application platform, wildfly elytron +2 moreWildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator7.4 High
- paysafe barzahlen payment module php sdkviafintech Barzahlen Payment Module PHP SDK Webhook.php verify timing discrepancy2.6 Low
- pylons horusPylons horus services.py timing discrepancy2.6 Low
- agnivade easy-scrypt, easy-script project easy-script +1 moreagnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancy2.6 Low
- ziftr primecoinZiftr primecoin bitcoinrpc.cpp HTTPAuthorized timing discrepancy2.6 Low
- instedd nuntiumInSTEDD Nuntium geopoll_controller.rb timing discrepancy3.1 Low
- openshift osin, redhat openshift osin, openshift container platform +2 moreOpenShift OSIN CheckClientSecret timing discrepancy2.6 Low
- gnu mailmanMailman Core vulnerable to timing attacks6.3 Medium
- jenkins generic webhook trigger, jenkins project generic webhook trigger plugin +1 moreNon-constant time webhook token comparison in Jenkins Generic Webhook Trigger Plugin5.3 Medium
- jenkins gitlab, jenkins project gitlab plugin +1 moreNon-constant time webhook token comparison in Jenkins GitLab Plugin5.3 Medium
- gocdGoCD API authentication of user access tokens subject to timing attack during comparison6.5 Medium
- runatlantis atlantisTiming Attack7.5 High
- jenkins github, jenkins project github plugin +1 moreJenkins GitHub plugin uses weak webhook signature function5.3 Medium
- fastify bearer-auth, fastify-bearer-auth +1 morePotential Timing Attack Vector in @fastify/bearer-auth7.5 High
- cisco unified communications manager, unity connection +1 moreCisco Unified Communications Products Timing Attack Vulnerability5.3 Medium
- jenkinsObservable timing discrepancy allows determining username validity in Jenkins7.5 High
ibexa/corePackagistLogin timing attack in ibexa/coreNo scoreezsystems/ezpublish-kernelPackagistLogin timing attack in ezsystems/ezpublish-kernelNo scoreezsystems/ezplatform-kernelPackagistLogin timing attack in ezsystems/ezplatform-kernelNo score- constantoine totp-rsObservable Timing Discrepancy in totp-rs4.2 Medium
- siemens ruggedcom i800, ruggedcom i801, ruggedcom i802 +88 more +90 moreA vulnerability has been identified in RUGGEDCOM ROS M2100 (All versions < V5.6.0), RUGGEDCOM ROS...7.5 High
- embedthis goaheadThe code that performs password matching when using 'Basic' HTTP authentication does not use a...9.8 Critical
- jenkins configuration as code, jenkins project configuration as code plugin +1 moreObservable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin5.3 Medium
- amd all supported processors, athlon firmware, athlon pro firmware +3 more +5 moreSide-channels Related to the x86 PREFETCH Instruction4.7 Medium
- amd all supported processors, arm cortex-a72, broadcom bcm2711 +6 more +8 moreAMD Speculative execution with Floating-Point Value Injection5.5 Medium
- amd all supported processors, arm cortex-a72, broadcom bcm2711 +6 more +8 moreAMD Speculative Code Store Bypass5.5 Medium
- websockets project websockets, oracle communications cloud native core policy, communications cloud native core security edge protection proxy +2 more +4 moreObservable Timing Discrepancy in aaugustin websockets library5.9 Medium
- flow flow-server, vaadin flow, vaadin +2 moreTiming side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-184.0 Medium
- vaadin, vaadin vaadin-server +1 moreTiming side channel vulnerability in UIDL request handler in Vaadin 7 and 84.0 Medium
- flow flow-server, vaadin flow, vaadin +2 moreTiming side channel vulnerability in endpoint request handler in Vaadin 15-194.0 Medium
com.vaadin:vaadin-bomMavenTiming side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-184.0 Mediumcom.vaadin:vaadin-bomMavenTiming side channel vulnerability in endpoint request handler in Vaadin 15-194.0 Medium- jose-node-cjs-runtime project jose-node-cjs-runtimePadding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime5.9 Medium
- panva jose-node-esm-runtime, jose-node-cjs-runtime project jose-node-cjs-runtime +1 morePadding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime5.9 Medium
- apache hiveTiming attack in Cookie signature verification5.9 Medium
- rubyonrails active record session storeActiverecord-session_store Vulnerable to Timing Attack5.3 Medium
- shrinerb shrineTiming attack in Shrine5.9 Medium
- django-basic-auth-ip-whitelist project django-basic-auth-ip-whitelistTiming attack on django-basic-auth-ip-whitelist2.2 Low
- torchbox wagtailPotential Observable Timing Discrepancy in Wagtail6.1 Medium
- jenkinsNon-constant time HMAC comparison5.3 Medium
- jenkinsNon-constant time comparison of inbound TCP agent connection secret5.3 Medium
- rack, fedoraproject fedora, opensuse leap +2 morePossible Information Leak / Session Hijack Vulnerability in Rack6.3 Medium
- parity libsecp256k1libsecp256k1 contains side-channel timing attack7.5 High
- floragunn search guardSearch Guard versions before 21.0 had an timing side channel issue when using the internal user...5.9 Medium
express-basic-authnpmexpress-basic-auth Timing Attack due to native string comparison instead of constant time string comparison3.1 Low- w1.fi hostapd, wi-fi alliance hostapd with sae support, fedoraproject fedora +7 more +9 moreThe implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacks5.9 Medium
- csrf-lite project csrf-lite, hackerone csrf-lite node module +1 moreTiming Attack in csrf-lite5.9 Medium
- python-jose project python-josepython-jose failure to use a constant time comparison for HMAC keys9.8 Critical
- Show moreLoading…