CWE-203: Observable Discrepancy, page 12

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

What the weakness is: CWE-203 at MITRE

1. 5.3CVE-2021-39021EPSS 0.5%2022-02-02

   IBM Guardium Data Encryption (GDE) 5.0.0.2 behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which could facilitate username enumeration. IBM X-Force ID: 21…

2. 5.3CVE-2022-21659EPSS 1.0%2022-01-31

   Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate exis…

3. 5.3CVE-2022-24032EPSS 1.0%2022-01-30

   Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform because a failed login attempt produces a different error message when the username is valid.

4. 5.3CVE-2019-25056EPSS 0.9%2022-01-26

   In Bromite through 78.0.3904.130, there are adblock rules in the release APK; therefore, probing which resources are blocked and which aren't can identify the application version and defeat the User-Agent protection mechanism.

5. 9.8CVE-2022-23304EPSS 1.9%2022-01-17

   The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.

6. 9.8CVE-2022-23303EPSS 3.1%2022-01-17

   The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.

7. 5.3CVE-2022-23106EPSS 1.1%2022-01-12

   Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.

8. 5.3CVE-2022-22120EPSS 1.4%2022-01-10

   In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered…

9. 5.3CVE-2021-20147EPSS 7.1%2022-01-03

   ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

10. 5.3CVE-2020-35398EPSS 1.2%2021-12-23

    An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the error message returned after invalid credentials are attempted.

11. 7.5CVE-2021-20049EPSS 1.4%2021-12-23

    A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x…

12. 6.5CVE-2021-38009EPSS 0.9%2021-12-23

    Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

13. 5.3CVE-2021-44876EPSS 0.8%2021-12-21

    Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application coun…

14. 5.3CVE-2021-44875EPSS 0.8%2021-12-21

    Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on SaaS tenant and user management, and on-premise database and web application coun…

15. 5.3CVE-2021-44554EPSS 1.1%2021-12-20

    Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the vector, an attacker can determine if a username exists thanks to the message retur…

16. 3.3CVE-2021-1032EPSS 0.1%2021-12-15

    In getMimeGroup of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no…

17. 3.3CVE-2021-1031EPSS 0.1%2021-12-15

    In cancelNotificationsFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local inform…

18. 5.5CVE-2021-1030EPSS 0.1%2021-12-15

    In setNotificationsShownFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local info…

19. 5.5CVE-2021-1026EPSS 0.1%2021-12-15

    In startRanging of RttServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additi…

20. 3.3CVE-2021-1018EPSS 0.1%2021-12-15

    In adjustStreamVolume of AudioService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no ad…

21. 3.3CVE-2021-1015EPSS 0.1%2021-12-15

    In getMeidForSlot of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with …

22. 5.5CVE-2021-1014EPSS 0.1%2021-12-15

    In getNetworkTypeForSubscriber of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information dis…

23. 5.5CVE-2021-1013EPSS 0.1%2021-12-15

    In checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission of PermissionManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th…

24. 5.5CVE-2021-1012EPSS 0.1%2021-12-15

    In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no…

25. 5.5CVE-2021-1009EPSS 0.1%2021-12-15

    In setApplicationCategoryHint of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disc…

26. 5.5CVE-2021-1005EPSS 0.1%2021-12-15

    In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosu…

27. 3.3CVE-2021-0995EPSS 0.1%2021-12-15

    In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local inform…

28. 3.3CVE-2021-0990EPSS 0.1%2021-12-15

    In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no…

29. 3.3CVE-2021-0989EPSS 0.1%2021-12-15

    In hasManageOngoingCallsPermission of TelecomServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information di…

30. 3.3CVE-2021-0988EPSS 0.1%2021-12-15

    In getLaunchedFromUid and getLaunchedFromPackage of ActivityClientController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to …

31. 3.3CVE-2021-0987EPSS 0.1%2021-12-15

    In getNeighboringCellInfo of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosu…

32. 6.5CVE-2021-43823EPSS 0.9%2021-12-13

    Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in private source code could be guessed by an authenticated but unauthorized actor. This issue aff…

33. 5.3CVE-2021-44848ExploitEPSS 23%2021-12-13

    In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whether the username exists.

34. 5.5CVE-2021-1924EPSS 0.2%2021-11-12

    Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Sna…

35. 5.3CVE-2021-43398EPSS 2.1%2021-11-04

    Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. Th…

36. 7.5CVE-2021-34580EPSS 1.0%2021-10-27

    In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.

37. 5.3CVE-2021-38476EPSS 0.8%2021-10-19

    InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of a username. This may allow an attacker to enumerate different user accounts.

38. 7.5CVE-2021-38562EPSS 1.8%2021-10-18

    Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against lib/RT/REST2/Middleware/Auth.pm.

39. 4.7CVE-2021-26318EPSS 0.3%2021-10-13

    A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information.

40. 7.5CVE-2021-24651EPSS 1.6%2021-10-11

    The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate …

41. 4.3CVE-2021-37968EPSS 1.3%2021-10-08

    Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

42. 4.3CVE-2021-20376EPSS 0.7%2021-10-07

    IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to there being an observable discrepancy in returned messages. IBM X-Force ID: 195568.

43. 5.9CVE-2021-38153EPSS 6.2%2021-09-22

    Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or high…

44. 4.3CVE-2021-34576EPSS 0.4%2021-09-16

    In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists. This may give sensitive information (water consumption without distinct values) to third parties.

45. 5.3CVE-2016-20012EPSS 5.3%2021-09-15

    OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when…

46. 5.3CVE-2021-39189EPSS 1.4%2021-09-15

    Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may appl…

47. 5.3CVE-2021-37151EPSS 0.9%2021-09-01

    CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. In certain authentication policy configurations with MFA, the API response length can be used to differentiate be…

48. 3.8CVE-2020-25082EPSS 0.2%2021-08-10

    An attacker with physical access to Nuvoton Trusted Platform Module (NPCT75x 7.2.x before 7.2.2.0) could extract an Elliptic Curve Cryptography (ECC) private key via a side-channel attack against ECDSA, because of an Observable Timing Disc…

49. 3.3CVE-2021-38209EPSS 0.3%2021-08-08

    net/netfilter/nf_conntrack_standalone.c in the Linux kernel before 5.12.2 allows observation of changes in any net namespace because these changes are leaked into all other net namespaces. This is related to the NF_SYSCTL_CT_MAX, NF_SYSCTL…

50. 5.3CVE-2021-3642EPSS 0.8%2021-08-05

    A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confident…