CWE-203 · Observable Discrepancy (page 2)
Page 2 of 8 — CVEs classified under CWE-203, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-46720 | Low | 3.1 | 2025-05-05 | Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mut… |
CVE-2021-47664 | Medium | 5.3 | 2025-04-24 | Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames. |
CVE-2025-32789 | Low | 3.1 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an at… |
CVE-2024-11084 | | 2025-04-15 | Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists. | |
CVE-2025-0361 | Medium | 4.3 | 2025-04-08 | During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowe… |
CVE-2025-31124 | Medium | 5.3 | 2025-03-31 | Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate a… |
CVE-2024-51477 | Medium | 4.3 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow an authenticated to obtain sensitive username information due to an observable response discrepancy. |
CVE-2024-13939 | High | 7.5 | 2025-03-28 | String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated… |
CVE-2025-30344 | Medium | 5.3 | 2025-03-21 | An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a… |
CVE-2025-1468 | High | 7.5 | 2025-03-18 | An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-… |
CVE-2025-29780 | | 2025-03-14 | Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0… | |
CVE-2024-41760 | Low | 3.7 | 2025-03-11 | IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an attacker to obtain sensitive information due to a timing attack during certain RSA… |
CVE-2025-27667 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20230524-001… |
CVE-2025-24023 | Low | 3.7 | 2025-03-03 | Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timi… |
CVE-2024-41335 | High | 7.5 | 2025-02-27 | Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor… |
CVE-2023-37482 | Medium | 5.3 | 2025-02-11 | The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could… |
CVE-2024-45089 | Medium | 4.3 | 2025-01-31 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition EBICS server could allow an authenticated user to obtain sensi… |
CVE-2025-24506 | | 2025-01-30 | A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types. | |
CVE-2023-37413 | Medium | 5.3 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy. |
CVE-2024-7881 | Medium | 5.1 | 2025-01-28 | An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an add… |
CVE-2023-47159 | Medium | 4.3 | 2025-01-27 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to enumerate usernames due to an observable dis… |
CVE-2024-35114 | Medium | 5.3 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts. |
CVE-2024-10929 | Medium | 5.1 | 2025-01-22 | In certain circumstances, an issue in Arm Cortex-A57, Cortex-A72 (revisions before r1p0), Cortex-A73 and Cortex-A75 may allow an adversary to gain a weak form… |
CVE-2024-43095 | High | 7.8 | 2025-01-21 | In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This could lead to local escalation of privile… |
CVE-2025-21510 | High | 7.5 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-24011 | Medium | 5.3 | 2025-01-21 | Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determin… |
CVE-2025-21336 | Medium | 5.6 | 2025-01-14 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2024-36510 | Medium | 5.3 | 2025-01-14 | An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7… |
CVE-2024-42174 | Low | 3.7 | 2025-01-11 | HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore comp… |
CVE-2024-13198 | Low | 3.7 | 2025-01-09 | A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulati… |
CVE-2024-54767 | High | 7.5 | 2025-01-06 | An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authenticati… |
CVE-2024-13028 | Low | 3.7 | 2024-12-29 | A vulnerability, which was classified as problematic, has been found in Antabot White-Jotter up to 0.2.2. This issue affects some unknown processing of the fil… |
CVE-2024-56738 | Medium | 5.3 | 2024-12-29 | GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks. |
CVE-2024-54454 | Medium | 5.3 | 2024-12-27 | An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. An Observable Response Discrepancy… |
CVE-2024-47150 | Low | 3.3 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-47149 | Low | 3.3 | 2024-12-26 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. |
CVE-2024-8994 | Medium | 6.2 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-8993 | Medium | 6.2 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-8992 | Medium | 4.0 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-47155 | Medium | 5.5 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-47154 | Medium | 5.5 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-47153 | Medium | 6.2 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-47156 | Low | 3.3 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-11297 | Medium | 5.3 | 2024-12-20 | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… |
CVE-2024-12663 | Low | 3.7 | 2024-12-16 | A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the comp… |
CVE-2024-54476 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to acces… |
CVE-2024-54002 | Medium | 5.3 | 2024-12-04 | Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login reques… |
CVE-2018-9364 | High | 7.5 | 2024-11-19 | In the LG LAF component, there is a special command that allowed modification of certain partitions. This could lead to bypass of secure boot. User interaction… |
CVE-2020-26062 | Medium | 5.3 | 2024-11-18 | A vulnerability in Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerab… |
CVE-2024-28885 | Medium | 5.9 | 2024-11-13 | Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access. |
CVE-2020-10369 | Medium | 5.5 | 2024-11-10 | Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory content via a "Spectra"… |
CVE-2020-10367 | Medium | 5.5 | 2024-11-10 | Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra" attack. |
CVE-2024-51739 | High | 7.5 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a va… |
CVE-2024-50102 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: x86: fix user address masking non-canonical speculation issue It turns out that AMD has a… |
CVE-2024-41741 | Medium | 5.3 | 2024-11-01 | IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in furthe… |
CVE-2024-40490 | High | 7.5 | 2024-11-01 | An issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Password function. |
CVE-2024-7010 | Medium | 5.9 | 2024-10-29 | mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing… |
CVE-2024-10463 | Medium | 6.5 | 2024-10-29 | Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Th… |
CVE-2024-49358 | Medium | 5.3 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http… |
CVE-2024-50383 | Medium | 5.9 | 2024-10-23 | Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-P… |
CVE-2024-50382 | Medium | 5.9 | 2024-10-23 | Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. T… |
CVE-2024-48644 | Medium | 5.3 | 2024-10-22 | Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote attackers to deter… |
CVE-2024-47678 | Critical | 9.4 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed c… |
CVE-2024-21251 | Low | 3.1 | 2024-10-15 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Difficult to… |
CVE-2024-21233 | Medium | 4.3 | 2024-10-15 | Vulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5… |
CVE-2024-21210 | Low | 3.7 | 2024-10-15 | Vulnerability in Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4 and… |
CVE-2024-21208 | Low | 3.7 | 2024-10-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2024-21206 | Medium | 4.3 | 2024-10-15 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affec… |
CVE-2024-47869 | Low | 3.7 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for t… |
CVE-2023-36325 | Low | 3.7 | 2024-10-09 | i2p before 2.3.0 (Java) allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation attack across the IPv4… |
CVE-2024-43546 | Medium | 5.6 | 2024-10-08 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2024-45231 | Medium | 5.3 | 2024-10-08 | An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password… |
CVE-2024-9513 | Low | 3.7 | 2024-10-04 | A vulnerability was found in Netadmin Software NetAdmin IAM up to 3.5 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2024-9398 | Medium | 5.3 | 2024-10-01 | By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that… |
CVE-2024-47129 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length o… |
CVE-2024-41715 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the… |
CVE-2024-8651 | Medium | 5.3 | 2024-09-19 | A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which… |
CVE-2024-23984 | Medium | 5.3 | 2024-09-16 | Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. |
CVE-2024-34336 | Medium | 5.3 | 2024-09-12 | User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the serv… |
CVE-2024-42343 | Medium | 5.3 | 2024-09-08 | Loway - CWE-204: Observable Response Discrepancy |
CVE-2024-45052 | Medium | 5.3 | 2024-09-04 | Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver auth… |
CVE-2024-39921 | High | 7.5 | 2024-09-04 | Observable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to V02L21NF0301, and IP… |
CVE-2024-45678 | Medium | 4.2 | 2024-09-03 | Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that r… |
CVE-2024-1543 | Medium | 4.1 | 2024-08-29 | The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a cont… |
CVE-2024-1544 | Medium | 4.1 | 2024-08-27 | Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the order of the elliptic… |
CVE-2024-41952 | Medium | 5.3 | 2024-07-31 | Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate atta… |
CVE-2024-38431 | Medium | 5.3 | 2024-07-30 | Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy |
CVE-2024-41880 | Medium | 5.3 | 2024-07-22 | In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and private routes. |
CVE-2024-39830 | High | 8.1 | 2024-07-03 | Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison f… |
CVE-2024-39891 | Medium | 5.3 | 2024-07-02 | In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-numb… |
CVE-2024-36996 | Medium | 5.3 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not… |
CVE-2024-38322 | Medium | 5.3 | 2024-06-28 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration… |
CVE-2022-48730 | Medium | 5.5 | 2024-06-20 | In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix potential spectre v1 gadget It appears like nr could be a Spectre v1… |
CVE-2024-6129 | Low | 3.7 | 2024-06-18 | A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Use… |
CVE-2024-6056 | Low | 3.7 | 2024-06-17 | A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2024-38465 | Medium | 5.3 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus error. |
CVE-2024-31870 | Low | 3.3 | 2024-06-15 | IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having a… |
CVE-2024-32926 | Medium | 5.5 | 2024-06-13 | there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure with no additional execu… |
CVE-2024-5697 | Medium | 4.3 | 2024-06-11 | A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox. This vulnerability affects Firefox… |
CVE-2024-5690 | Medium | 4.3 | 2024-06-11 | By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulner… |