CWE-203 · Observable Discrepancy (page 3)
Page 3 of 8 — CVEs classified under CWE-203, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21251 | Low | 3.1 | 2024-10-15 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5. Difficult to… |
CVE-2024-21233 | Medium | 4.3 | 2024-10-15 | Vulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4-23.5… |
CVE-2024-21210 | Low | 3.7 | 2024-10-15 | Vulnerability in Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4 and… |
CVE-2024-21208 | Low | 3.7 | 2024-10-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported ve… |
CVE-2024-21206 | Medium | 4.3 | 2024-10-15 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affec… |
CVE-2024-47869 | Low | 3.7 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **timing attack** in the way Gradio compares hashes for t… |
CVE-2023-36325 | Low | 3.7 | 2024-10-09 | i2p before 2.3.0 (Java) allows de-anonymizing the public IPv4 and IPv6 addresses of i2p hidden services (aka eepsites) via a correlation attack across the IPv4… |
CVE-2024-43546 | Medium | 5.6 | 2024-10-08 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2024-45231 | Medium | 5.3 | 2024-10-08 | An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The django.contrib.auth.forms.PasswordResetForm class, when used in a view implementing password… |
CVE-2024-9513 | Low | 3.7 | 2024-10-04 | A vulnerability was found in Netadmin Software NetAdmin IAM up to 3.5 and classified as problematic. Affected by this issue is some unknown functionality of th… |
CVE-2024-9398 | Medium | 5.3 | 2024-10-01 | By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that… |
CVE-2024-47129 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length o… |
CVE-2024-41715 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the… |
CVE-2024-8651 | Medium | 5.3 | 2024-09-19 | A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which… |
CVE-2024-23984 | Medium | 5.3 | 2024-09-16 | Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. |
CVE-2024-34336 | Medium | 5.3 | 2024-09-12 | User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the serv… |
CVE-2024-42343 | Medium | 5.3 | 2024-09-08 | Loway - CWE-204: Observable Response Discrepancy |
CVE-2024-45052 | Medium | 5.3 | 2024-09-04 | Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver auth… |
CVE-2024-39921 | High | 7.5 | 2024-09-04 | Observable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to V02L21NF0301, and IP… |
CVE-2024-45678 | Medium | 4.2 | 2024-09-03 | Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that r… |
CVE-2024-1543 | Medium | 4.1 | 2024-08-29 | The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a cont… |
CVE-2024-1544 | Medium | 4.1 | 2024-08-27 | Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the order of the elliptic… |
CVE-2024-41952 | Medium | 5.3 | 2024-07-31 | Zitadel is an open source identity management system. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate atta… |
CVE-2024-38431 | Medium | 5.3 | 2024-07-30 | Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy |
CVE-2024-41880 | Medium | 5.3 | 2024-07-22 | In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and private routes. |
CVE-2024-39830 | High | 8.1 | 2024-07-03 | Mattermost versions 9.8.x <= 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2 and 9.5.x <= 9.5.5, when shared channels are enabled, fail to use constant time comparison f… |
CVE-2024-39891 | Medium | 5.3 | 2024-07-02 | In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-numb… |
CVE-2024-36996 | Medium | 5.3 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not… |
CVE-2024-38322 | Medium | 5.3 | 2024-06-28 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration… |
CVE-2022-48730 | Medium | 5.5 | 2024-06-20 | In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix potential spectre v1 gadget It appears like nr could be a Spectre v1… |
CVE-2024-6129 | Low | 3.7 | 2024-06-18 | A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Use… |
CVE-2024-6056 | Low | 3.7 | 2024-06-17 | A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2024-38465 | Medium | 5.3 | 2024-06-16 | Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus error. |
CVE-2024-31870 | Low | 3.3 | 2024-06-15 | IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having a… |
CVE-2024-32926 | Medium | 5.5 | 2024-06-13 | there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure with no additional execu… |
CVE-2024-5697 | Medium | 4.3 | 2024-06-11 | A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox. This vulnerability affects Firefox… |
CVE-2024-5690 | Medium | 4.3 | 2024-06-11 | By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulner… |
CVE-2024-37880 | High | 7.5 | 2024-06-10 | The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a timing side channel th… |
CVE-2024-2408 | Medium | 5.9 | 2024-06-09 | The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless… |
CVE-2024-31878 | Medium | 5.3 | 2024-06-07 | IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can be used by a malici… |
CVE-2024-5124 | High | 7.5 | 2024-06-06 | A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is pres… |
CVE-2023-30312 | High | 7.3 | 2024-05-28 | An issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to a denial of service… |
CVE-2023-30308 | Medium | 6.5 | 2024-05-28 | An issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hijack TCP sessions which could lead to a d… |
CVE-2020-35165 | Medium | 5.1 | 2024-05-22 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vul… |
CVE-2021-47226 | High | 7.1 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer Both Intel and AMD… |
CVE-2024-30171 | Medium | 5.9 | 2024-05-14 | An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exceptio… |
CVE-2024-27839 | Low | 3.3 | 2024-05-14 | A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 17.5 and iPadOS 17.5. A malicious application may… |
CVE-2023-27283 | Medium | 5.3 | 2024-05-04 | IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545. |
CVE-2021-20556 | Medium | 5.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames… |
CVE-2024-30176 | Medium | 5.3 | 2024-05-01 | In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets. |
CVE-2024-30257 | Low | 3.9 | 2024-04-18 | 1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac… |
CVE-2024-26221 | High | 7.2 | 2024-04-09 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2024-2464 | Medium | 6.3 | 2024-03-21 | This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute f… |
CVE-2024-28868 | Low | 3.7 | 2024-03-20 | Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration… |
CVE-2023-5388 | Medium | 6.5 | 2024-03-19 | NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data… |
CVE-2024-25651 | Medium | 5.3 | 2024-03-14 | User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid… |
CVE-2023-5410 | High | 8.2 | 2024-03-12 | A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigati… |
CVE-2024-24766 | Medium | 6.2 | 2024-03-06 | CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed… |
CVE-2023-38362 | Medium | 5.3 | 2024-03-04 | IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814. |
CVE-2024-0436 | Medium | 5.9 | 2024-02-26 | Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack giv… |
CVE-2022-45177 | High | 7.5 | 2024-02-21 | An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under the /api/v1/vdeskintegration/user/isena… |
CVE-2024-26268 | Medium | 5.3 | 2024-02-20 | User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before updat… |
CVE-2023-50306 | Medium | 4.0 | 2024-02-20 | IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337. |
CVE-2022-48220 | Medium | 6.4 | 2024-02-14 | Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass… |
CVE-2024-25714 | Critical | 9.8 | 2024-02-11 | In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when… |
CVE-2023-6935 | Medium | 5.9 | 2024-02-09 | wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following… |
CVE-2024-25191 | Critical | 9.8 | 2024-02-08 | php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-25190 | Critical | 9.8 | 2024-02-08 | l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-25189 | Critical | 9.8 | 2024-02-08 | libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-25146 | Medium | 5.3 | 2024-02-08 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported ve… |
CVE-2023-51437 | High | 7.4 | 2024-02-07 | Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signa… |
CVE-2024-0202 | Medium | 5.9 | 2024-02-05 | A security vulnerability has been identified in the cryptlib cryptographic library when cryptlib is compiled with the support for RSA key exchange ciphersuites… |
CVE-2023-50782 | High | 7.5 | 2024-02-05 | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchan… |
CVE-2023-50781 | High | 7.5 | 2024-02-05 | A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to… |
CVE-2023-6240 | Medium | 6.5 | 2024-02-04 | A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt c… |
CVE-2021-21575 | Medium | 5.9 | 2024-02-02 | Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability. |
CVE-2023-5992 | Medium | 5.6 | 2024-01-31 | A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potentia… |
CVE-2024-23170 | Medium | 5.5 | 2024-01-31 | An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could… |
CVE-2024-0914 | Medium | 5.9 | 2024-01-31 | A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potent… |
CVE-2023-6258 | High | 8.1 | 2024-01-30 | A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited success… |
CVE-2024-21671 | Low | 3.7 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is poss… |
CVE-2024-0564 | Medium | 5.3 | 2024-01-30 | A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4… |
CVE-2024-22647 | Medium | 5.3 | 2024-01-30 | An user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user authentication, where a difference in error messages could allow… |
CVE-2024-23218 | Medium | 5.9 | 2024-01-23 | A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPad… |
CVE-2024-23342 | High | 7.4 | 2024-01-23 | The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorith… |
CVE-2024-21484 | High | 7.5 | 2024-01-22 | Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can dec… |
CVE-2024-23771 | Critical | 9.8 | 2024-01-22 | darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication vi… |
CVE-2024-0553 | High | 7.5 | 2024-01-16 | A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts wit… |
CVE-2023-52323 | Medium | 5.9 | 2024-01-05 | PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. |
CVE-2023-46739 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that coul… |
CVE-2023-50708 | Medium | 6.1 | 2023-12-22 | yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2… |
CVE-2023-41097 | Medium | 4.6 | 2023-12-21 | An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This i… |
CVE-2023-6135 | Medium | 4.3 | 2023-12-19 | Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private k… |
CVE-2023-23584 | Medium | 4.3 | 2023-12-18 | An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would… |
CVE-2023-50979 | Medium | 5.9 | 2023-12-18 | Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding. |
CVE-2023-4421 | Medium | 6.5 | 2023-12-12 | The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding… |
CVE-2023-45287 | High | 7.5 | 2023-12-05 | Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but… |
CVE-2023-40090 | Medium | 6.5 | 2023-12-04 | In BTM_BleVerifySignature of btm_ble.cc, there is a possible way to bypass signature validation due to side channel information disclosure. This could lead to… |
CVE-2023-49092 | Medium | 5.9 | 2023-11-28 | RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through ti… |
CVE-2023-5981 | Medium | 5.9 | 2023-11-28 | A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct… |