CWE-203 · Observable Discrepancy (page 2)
Page 2 of 8 — CVEs classified under CWE-203, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-56423 | Medium | 5.3 | 2025-11-24 | An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitive information via… |
CVE-2025-12888 | High | 7.5 | 2025-11-21 | Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limit… |
CVE-2025-11932 | Medium | 4.3 | 2025-11-21 | The server previously verified the TLS 1.3 PSK binder using a non-constant time method which could potentially leak information about the PSK binder |
CVE-2025-64749 | Medium | 4.3 | 2025-11-13 | Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API… |
CVE-2025-59716 | Medium | 5.3 | 2025-11-05 | ownCloud Guests before 0.12.5 allows unauthenticated user enumeration via the /apps/guests/register/{email}/{token} endpoint. Because of insufficient validatio… |
CVE-2025-11145 | High | 7.5 | 2025-10-24 | Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerabi… |
CVE-2025-36225 | Medium | 4.3 | 2025-10-09 | IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of retu… |
CVE-2025-11443 | Low | 3.7 | 2025-10-08 | A weakness has been identified in JhumanJ OpnForm up to 1.9.3. This affects an unknown function of the file /api/password/email of the component Forgotten Pass… |
CVE-2025-54477 | Medium | 5.3 | 2025-09-30 | Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method. |
CVE-2025-41252 | High | 7.5 | 2025-09-29 | Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potent… |
CVE-2025-1396 | Low | 3.7 | 2025-09-26 | A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distin… |
CVE-2025-10890 | Critical | 9.1 | 2025-09-24 | Side-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2025-9031 | Medium | 4.3 | 2025-09-24 | Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. This issue affects D… |
CVE-2025-43786 | Medium | 5.3 | 2025-09-09 | Enumeration of ERC from object entry in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024… |
CVE-2025-39702 | Critical | 9.8 | 2025-09-05 | In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to… |
CVE-2025-48561 | Medium | 5.5 | 2025-09-04 | In multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure. This could lead to local info… |
CVE-2025-57770 | Medium | 5.3 | 2025-08-22 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.2, 3.0.0 to 3.3.6… |
CVE-2025-43751 | Medium | 5.3 | 2025-08-22 | User enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0… |
CVE-2025-43743 | Medium | 4.3 | 2025-08-19 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-43739 | Medium | 4.3 | 2025-08-19 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-9109 | Low | 3.7 | 2025-08-18 | A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email… |
CVE-2025-8774 | Low | 2.5 | 2025-08-09 | A vulnerability has been found in riscv-boom SonicBOOM up to 2.2.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-54999 | Low | 3.7 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 thro… |
CVE-2025-47872 | Medium | 5.8 | 2025-08-08 | The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registe… |
CVE-2025-6011 | Low | 3.7 | 2025-08-01 | A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users… |
CVE-2025-24391 | Medium | 5.3 | 2025-07-14 | A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and… |
CVE-2023-38327 | Medium | 5.3 | 2025-07-11 | An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unauthenticated remote a… |
CVE-2025-6386 | High | 7.5 | 2025-07-07 | The parisneo/lollms repository is affected by a timing attack vulnerability in the `authenticate_user` function within the `lollms_authentication.py` file. Thi… |
CVE-2025-6056 | | 2025-07-04 | Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate use… | |
CVE-2025-27451 | Medium | 5.3 | 2025-07-03 | For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existin… |
CVE-2025-40732 | High | 7.5 | 2025-06-30 | user enumeration vulnerability in Daily Expense Manager v1.0. To exploit this vulnerability a POST request must be sent using the name parameter in /check.php |
CVE-2025-52576 | Medium | 5.3 | 2025-06-25 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP… |
CVE-2025-46570 | Low | 2.6 | 2025-05-29 | vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanis… |
CVE-2024-47057 | Medium | 5.3 | 2025-05-28 | SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by… |
CVE-2025-46804 | Low | 3.3 | 2025-05-26 | A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not… |
CVE-2025-23182 | Medium | 4.3 | 2025-05-22 | CWE-203: Observable Discrepancy |
CVE-2025-3939 | Medium | 5.3 | 2025-05-22 | Observable Response Discrepancy vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX a… |
CVE-2025-46720 | Low | 3.1 | 2025-05-05 | Keystone is a content management system for Node.js. Prior to version 6.5.0, `{field}.isFilterable` access control can be bypassed in `update` and `delete` mut… |
CVE-2021-47664 | Medium | 5.3 | 2025-04-24 | Due to improper authentication mechanism an unauthenticated remote attacker can enumerate valid usernames. |
CVE-2025-32789 | Low | 3.1 | 2025-04-16 | EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an at… |
CVE-2024-11084 | | 2025-04-15 | Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exists. | |
CVE-2025-0361 | Medium | 4.3 | 2025-04-08 | During an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowe… |
CVE-2025-31124 | Medium | 5.3 | 2025-03-31 | Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate a… |
CVE-2024-51477 | Medium | 4.3 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow an authenticated to obtain sensitive username information due to an observable response discrepancy. |
CVE-2024-13939 | High | 7.5 | 2025-03-28 | String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated… |
CVE-2025-30344 | Medium | 5.3 | 2025-03-21 | An issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depending on whether a… |
CVE-2025-1468 | High | 7.5 | 2025-03-18 | An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA Server with the non-… |
CVE-2025-29780 | | 2025-03-14 | Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0… | |
CVE-2024-41760 | Low | 3.7 | 2025-03-11 | IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an attacker to obtain sensitive information due to a timing attack during certain RSA… |
CVE-2025-27667 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumeration OVE-20230524-001… |
CVE-2025-24023 | Low | 3.7 | 2025-03-03 | Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timi… |
CVE-2024-41335 | High | 7.5 | 2025-02-27 | Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor… |
CVE-2023-37482 | Medium | 5.3 | 2025-02-11 | The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could… |
CVE-2024-45089 | Medium | 4.3 | 2025-01-31 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition EBICS server could allow an authenticated user to obtain sensi… |
CVE-2025-24506 | | 2025-01-30 | A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types. | |
CVE-2023-37413 | Medium | 5.3 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy. |
CVE-2024-7881 | Medium | 5.1 | 2025-01-28 | An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume those contents as an add… |
CVE-2023-47159 | Medium | 4.3 | 2025-01-27 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to enumerate usernames due to an observable dis… |
CVE-2024-35114 | Medium | 5.3 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts. |
CVE-2024-10929 | Medium | 5.1 | 2025-01-22 | In certain circumstances, an issue in Arm Cortex-A57, Cortex-A72 (revisions before r1p0), Cortex-A73 and Cortex-A75 may allow an adversary to gain a weak form… |
CVE-2024-43095 | High | 7.8 | 2025-01-21 | In multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This could lead to local escalation of privile… |
CVE-2025-21510 | High | 7.5 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-24011 | Medium | 5.3 | 2025-01-21 | Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determin… |
CVE-2025-21336 | Medium | 5.6 | 2025-01-14 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2024-36510 | Medium | 5.3 | 2025-01-14 | An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7… |
CVE-2024-42174 | Low | 3.7 | 2025-01-11 | HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore comp… |
CVE-2024-13198 | Low | 3.7 | 2025-01-09 | A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulati… |
CVE-2024-54767 | High | 7.5 | 2025-01-06 | An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authenticati… |
CVE-2024-13028 | Low | 3.7 | 2024-12-29 | A vulnerability, which was classified as problematic, has been found in Antabot White-Jotter up to 0.2.2. This issue affects some unknown processing of the fil… |
CVE-2024-56738 | Medium | 5.3 | 2024-12-29 | GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks. |
CVE-2024-54454 | Medium | 5.3 | 2024-12-27 | An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. An Observable Response Discrepancy… |
CVE-2024-47150 | Low | 3.3 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-47149 | Low | 3.3 | 2024-12-26 | Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. |
CVE-2024-8994 | Medium | 6.2 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-8993 | Medium | 6.2 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-8992 | Medium | 4.0 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-47155 | Medium | 5.5 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-47154 | Medium | 5.5 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-47153 | Medium | 6.2 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-47156 | Low | 3.3 | 2024-12-26 | Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. |
CVE-2024-11297 | Medium | 5.3 | 2024-12-20 | The Page Restriction WordPress (WP) – Protect WP Pages/Post plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… |
CVE-2024-12663 | Low | 3.7 | 2024-12-16 | A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the comp… |
CVE-2024-54476 | Medium | 5.5 | 2024-12-12 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to acces… |
CVE-2024-54002 | Medium | 5.3 | 2024-12-04 | Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login reques… |
CVE-2018-9364 | High | 7.5 | 2024-11-19 | In the LG LAF component, there is a special command that allowed modification of certain partitions. This could lead to bypass of secure boot. User interaction… |
CVE-2020-26062 | Medium | 5.3 | 2024-11-18 | A vulnerability in Cisco Integrated Management Controller could allow an unauthenticated, remote attacker to enumerate valid usernames within the vulnerab… |
CVE-2024-28885 | Medium | 5.9 | 2024-11-13 | Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access. |
CVE-2020-10369 | Medium | 5.5 | 2024-11-10 | Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory content via a "Spectra"… |
CVE-2020-10367 | Medium | 5.5 | 2024-11-10 | Certain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra" attack. |
CVE-2024-51739 | High | 7.5 | 2024-11-05 | Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a va… |
CVE-2024-50102 | Medium | 5.5 | 2024-11-05 | In the Linux kernel, the following vulnerability has been resolved: x86: fix user address masking non-canonical speculation issue It turns out that AMD has a… |
CVE-2024-41741 | Medium | 5.3 | 2024-11-01 | IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in furthe… |
CVE-2024-40490 | High | 7.5 | 2024-11-01 | An issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Password function. |
CVE-2024-7010 | Medium | 5.9 | 2024-10-29 | mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing… |
CVE-2024-10463 | Medium | 6.5 | 2024-10-29 | Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Th… |
CVE-2024-49358 | Medium | 5.3 | 2024-10-24 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint `http… |
CVE-2024-50383 | Medium | 5.9 | 2024-10-23 | Botan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna128 (used in Chacha-P… |
CVE-2024-50382 | Medium | 5.9 | 2024-10-23 | Botan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in GHASH in AES-GCM. T… |
CVE-2024-48644 | Medium | 5.3 | 2024-10-22 | Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote attackers to deter… |
CVE-2024-47678 | Critical | 9.4 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved: icmp: change the order of rate limits ICMP messages are ratelimited : After the blamed c… |