CWE-208: Observable Timing Discrepancy
Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
A kind of CWE-203 Observable Discrepancy.
From the CWE List. © The MITRE Corporation.
Newest
- davidosipov postquantum-feldman-vssPost-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations5.8 Medium
- ibm common cryptographic architecture, 4769 developers toolkit +1 moreIBM Common Cryptographic Architecture information disclosure6.5 Medium
- mikrotik routerosAn issue was discovered in the Winbox service of MikroTik RouterOS v6.43 through v7.16.1. A...5.4 Medium
- opcfoundation ua .net standard stack, siemens simatic energy manager pro v7.2, simatic energy manager pro v7.3 +3 more +5 moreSecurity Update for the OPC UA .NET Standard Stack8.6 High
- apache hiveApache Hive: Timing Attack Against Signature in LLAP util6.5 Medium
- aws sign-in iam login flowIssue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration6.9 Medium
- gnu grub2GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp...5.3 Medium
- goauthentik authentikauthentik allows a timing attack due to missing constant time comparison for metrics view6.3 Medium
qatengineopenSUSE,qatlibopenSUSE,qatzipSUSE +2 moreObservable timing discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1...8.2 High- ibm txseries for multiplatformsIBM TXSeries for Multiplatforms information disclosure5.3 Medium
- mudler localai, mudler/localai +1 moreTiming Attack in mudler/localai7.5 High
- gradio-app gradioNon-constant-time comparison when comparing hashes in Gradio2.3 Low
- expressjs basic-auth-connectbasic-auth-connect's callback uses time unsafe string comparison8.7 High
- ethyca fidesFides Webserver Authentication Timing-Based Username Enumeration Vulnerability5.3 Medium
- wolfssl, wolfssl wolfcrypt +1 moreAES T-Table sub-cache-line leakage4.1 Medium
- matrix olmAn issue was discovered in Matrix libolm (aka Olm) through 3.2.16. The AES implementation is...5.3 Medium
- open-telemetry opentelemetry-collector-contrib, opentelemetry collector contrib +1 moreopen-telemetry has an Observable Timing Discrepancy6.5 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +24 more +26 moreWindows Kerberos Elevation of Privilege Vulnerability8.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time2.6 Low
- matrix-org vodozemacUsage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac2.9 Low
- djangoproject djangoDjango vulnerable to user enumeration attack5.3 Medium
- open-quantum-safe liboqsControl-flow timing leak in Kyber reference implementation when compiled with Clang 15-18 for -Os, -O1 and other options5.9 Medium
- dell bsafe crypto-c micro edition, bsafe micro edition suite, bsafe crypto-c-micro-edition +1 more +3 moreDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite,...5.1 Medium
- redhat openssl, red hat enterprise linux 6, enterprise linux 7 +2 more +4 morePerl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)5.9 Medium
- red hat enterprise linux 8, enterprise linux 9 +1 moreRust-openssl: timing based side-channel can lead to a bleichenbacher style attack5.9 Medium
- vantage6Username timing attack on recover password/MFA token in vantage65.3 Medium
- apache dorisApache Doris: Timing Attack weakness9.8 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +7 more +9 moreLibgcrypt: vulnerable to marvin attack5.9 Medium
- m2crypto project m2crypto, red hat enterprise linux 6, enterprise linux 7 +7 more +9 moreM2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-256577.5 High
- cryptlibCryptlib: rsa key exchange ciphersuites in tls vulnerable to marvin attack5.9 Medium
- dell bsafe micro edition suite, bsafe micro-edition-suite +1 moreDell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy...5.9 Medium
- vantage6vantage6 username timing attack3.7 Low
- tlsfuzzer ecdsa, python-ecdsa +1 morepython-ecdsa vulnerable to Minerva attack on P-2567.4 High
- silabs.com gsdk, silabs gecko software development kit +1 morePotential Timing vulnerability in CBC PKCS7 padding calculations4.6 Medium
- couchbase server, cryptography.io cryptography, red hat ansible automation platform 2 +8 more +10 morePython-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-256597.5 High
- gnu gnutls, debian linux, fedoraproject fedora +12 more +14 moreGnutls: timing side-channel in the rsa-psk authentication5.9 Medium
- jhipstergenerator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character7.5 High
- jenkins zanata, jenkins project zanata plugin +1 moreNon-constant time webhook token hash comparison in Jenkins Zanata Plugin5.3 Medium
- jenkins msteams webhook trigger, jenkins project msteams webhook trigger plugin +1 moreJenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison5.3 Medium
- jenkins gogs, jenkins project gogs plugin +1 moreJenkins Gogs Plugin uses non-constant time webhook token comparison5.3 Medium
- jenkins multibranch scan webhook trigger, jenkins project multibranch scan webhook trigger plugin +1 moreJenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison5.3 Medium
- texas instruments omap, ti omap l138 firmware +1 moreSK_LOAD timing side channel during AES module decryption in Texas Instruments OMAP L1384.4 Medium
- linuxfoundation harbor, harbor project +1 moreTiming attack risk in Harbor5.9 Medium
- nvidia dgx a100 bmc, dgx h100 bmc, dgx h100 firmware +2 moreNVIDIA DGX H100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated...8.0 High
- mesosoi silverwaregames-io-issue-tracker, silverwaregames +1 moresilverware-io-issue-tracker server responds in a noticeably different amount of time depending if a given email address exists or not3.7 Low
- oppiaTiming Attack Reveals CSRF Tokens in oppia5.3 Medium
- saleorNon-constant time HMAC comparison in Adyen plugin in Saleor4.8 Medium
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations5.0 Medium
- answer, answerdev answerdev/answer +1 moreObservable Timing Discrepancy in answerdev/answer5.3 Medium
- amazon opensearch, opensearch security, embysupport security +2 moreTime discrepancy in authentication responses in OpenSearch5.3 Medium
- Show moreLoading…