cve.bz

CWE-203: Observable Discrepancy, page 5

Filter

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.

What the weakness is: CWE-203 at MITRE

Ask an AI about CWE-203

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-203: Observable Discrepancy and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/203.html and https://cve.bz/cve/cwe/203?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2024-47149EPSS 0.2%

    Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.

  2. 5.5CVE-2024-8994EPSS 0.2%

    Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.

  3. 5.5CVE-2024-8993EPSS 0.2%

    Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.

  4. 5.5CVE-2024-8992EPSS 0.2%

    Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.

  5. 5.5CVE-2024-47155EPSS 0.2%

    Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.

  6. 5.5CVE-2024-47154EPSS 0.2%

    Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.

  7. 5.5CVE-2024-47153EPSS 0.2%

    Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.

  8. 5.5CVE-2024-47156EPSS 0.1%

    Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.

  9. 7.5CVE-2024-11297EPSS 0.6%

    The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.6 via the WordPress core search feature. This makes it possible for …

  10. 6.3CVE-2024-12663EPSS 0.4%

    A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the component Login. The manipulation of the argument username leads to observable respo…

  11. 5.5CVE-2024-54476EPSS 0.3%

    The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access user-sensitive data.

  12. 5.3CVE-2024-54002EPSS 0.3%

    Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the syst…

  13. 7.5CVE-2018-9364EPSS 0.2%

    In the LG LAF component, there is a special command that allowed modification of certain partitions. This could lead to bypass of secure boot. User interaction is not needed for exploitation.

  14. 5.3CVE-2020-26062EPSS 0.8%

    A vulnerability in Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerable application. The vulnerability is due to differences in authentication respo…

  15. 8.2CVE-2024-28885EPSS 0.4%

    Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access.

  16. 5.5CVE-2020-10369EPSS 0.4%

    Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory content via a "Spectra" attack.

  17. 5.5CVE-2020-10367EPSS 0.4%

    Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra" attack.

  18. 5.3CVE-2024-51739ExploitEPSS 1.2%

    Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer …

  19. 5.5CVE-2024-50102EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: x86: fix user address masking non-canonical speculation issue It turns out that AMD has a "Meltdown Lite(tm)" issue with non-canonical accesses in kernel space. And so …

  20. 5.3CVE-2024-41741EPSS 0.3%

    IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in further attacks against the system.

  21. 7.5CVE-2024-40490EPSS 0.5%

    An issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Password function.

  22. 5.9CVE-2024-7010EPSS 0.5%

    mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the contex…

  23. 6.5CVE-2024-10463EPSS 0.7%

    Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.

  24. 5.3CVE-2024-49358EPSS 0.5%

    ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http://<Server-IP>/v1/users/login` in ZimaOS returns distinct responses based on whet…

  25. 5.9CVE-2024-50383EPSS 0.5%

    Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-Poly1305 and x25519). An addition can be skipped if a carry is not set. This was …

  26. 5.9CVE-2024-50382EPSS 0.5%

    Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. There is a branch instead of an XOR with carry. This was observed for Clang in LL…

  27. 5.3CVE-2024-48644EPSS 0.8%

    Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote attackers to determine valid user accounts via login attempts. This can lead to the enumeration of…

  28. 5.5CVE-2024-47678EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed commits, the two rate limiters are applied in this order: 1) host wide ratelimit…

  29. 3.1CVE-2024-21251EPSS 0.4%

    Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Difficult to exploit vulnerability allows low privileged attacker having Create Session, Cre…

  30. 4.3CVE-2024-21233EPSS 0.4%

    Vulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Easily exploitable vulnerability allows low privileged attacker having Create S…

  31. 3.7CVE-2024-21210EPSS 0.8%

    Vulnerability in Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4 and 23. Difficult to exploit vulnerability allows unauthenticated attacker with ne…

  32. 3.7CVE-2024-21208EPSS 1.0%

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12…

  33. 4.3CVE-2024-21206EPSS 0.4%

    Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are ECC:11-13. Easily exploitable vulnerability allows low privileged attack…

  34. 2.3CVE-2024-47869EPSS 0.3%

    Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for the `analytics_dashboard` function. Since the comparison is not done in constant …

  35. 3.7CVE-2023-36325EPSS 0.5%

    i2p before 2.3.0 (Java) allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation attack across the IPv4 and IPv6 addresses that occurs when a tunneled, replayed message has a behavior…

  36. 5.6CVE-2024-43546EPSS 0.6%

    Windows Cryptographic Information Disclosure Vulnerability

  37. 5.3CVE-2024-45231EPSS 0.8%

    An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password reset flows, allows remote attackers to enumerate user e-mail addresses by send…

  38. 6.3CVE-2024-9513EPSS 1.7%

    A vulnerability was found in Netadmin Software NetAdmin IAM up to 3.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /controller/api/Answer/ReturnUserQuestionsFilled of the component HTTP PO…

  39. 5.3CVE-2024-9398EPSS 0.6%

    By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox…

  40. 5.3CVE-2024-47129EPSS 0.1%

    The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used.

  41. 5.3CVE-2024-41715EPSS 0.1%

    The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length of the payload regardless of the encryption used.

  42. 6.9CVE-2024-8651EPSS 0.4%

    A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which could be a basis for further attacks. This issue affects NetCat CMS v. 6.4.0.241…

  43. 6.8CVE-2024-23984EPSS 0.2%

    Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.

  44. 5.3CVE-2024-34336EPSS 0.4%

    User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality.

  45. 7.5CVE-2024-42343EPSS 0.3%

    Loway - CWE-204: Observable Response Discrepancy

  46. 5.3CVE-2024-45052EPSS 0.6%

    Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine t…

  47. 7.5CVE-2024-39921EPSS 0.4%

    Observable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to V02L21NF0301, and IPCOM VE2 Series V01L04NF0001 to V01L06NF0112. If this vulnerability is exploited,…

  48. 4.2CVE-2024-45678EPSS 0.3%

    Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic sid…

  49. 5.5CVE-2024-1543EPSS 0.2%

    The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a controlled environment such as Intel SGX, an attacker can gain a per instruction sub…

  50. 4.9CVE-2024-1544EPSS 0.3%

    Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the order of the elliptic curve. Meaning k = r mod n. The division used during the reduction estimates a…