CWE-203 · Observable Discrepancy (page 3)
Page 3 of 8 — CVEs classified under CWE-203, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37880 | High | 7.5 | 2024-06-10 | The Kyber reference implementation before 9b8d306, when compiled by LLVM Clang through 18.x with some common optimization options, has a timing side channel th… |
CVE-2024-2408 | Medium | 5.9 | 2024-06-09 | The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless… |
CVE-2024-31878 | Medium | 5.3 | 2024-06-07 | IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can be used by a malici… |
CVE-2024-5124 | High | 7.5 | 2024-06-06 | A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is pres… |
CVE-2023-30312 | High | 7.3 | 2024-05-28 | An issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to a denial of service… |
CVE-2023-30308 | Medium | 6.5 | 2024-05-28 | An issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hijack TCP sessions which could lead to a d… |
CVE-2020-35165 | Medium | 5.1 | 2024-05-22 | Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vul… |
CVE-2021-47226 | High | 7.1 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer Both Intel and AMD… |
CVE-2024-30171 | Medium | 5.9 | 2024-05-14 | An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. Timing-based leakage may occur in RSA based handshakes because of exceptio… |
CVE-2024-27839 | Low | 3.3 | 2024-05-14 | A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 17.5 and iPadOS 17.5. A malicious application may… |
CVE-2023-27283 | Medium | 5.3 | 2024-05-04 | IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545. |
CVE-2021-20556 | Medium | 5.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames… |
CVE-2024-30176 | Medium | 5.3 | 2024-05-01 | In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets. |
CVE-2024-30257 | Low | 3.9 | 2024-04-18 | 1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac… |
CVE-2024-26221 | High | 7.2 | 2024-04-09 | Windows DNS Server Remote Code Execution Vulnerability |
CVE-2024-2464 | Medium | 6.3 | 2024-03-21 | This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute f… |
CVE-2024-28868 | Low | 3.7 | 2024-03-20 | Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration… |
CVE-2023-5388 | Medium | 6.5 | 2024-03-19 | NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data… |
CVE-2024-25651 | Medium | 5.3 | 2024-03-14 | User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid… |
CVE-2023-5410 | High | 8.2 | 2024-03-12 | A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigati… |
CVE-2024-24766 | Medium | 6.2 | 2024-03-06 | CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed… |
CVE-2023-38362 | Medium | 5.3 | 2024-03-04 | IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814. |
CVE-2024-0436 | Medium | 5.9 | 2024-02-26 | Theoretically, it would be possible for an attacker to brute-force the password for an instance in single-user password protection mode via a timing attack giv… |
CVE-2022-45177 | High | 7.5 | 2024-02-21 | An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under the /api/v1/vdeskintegration/user/isena… |
CVE-2024-26268 | Medium | 5.3 | 2024-02-20 | User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before updat… |
CVE-2023-50306 | Medium | 4.0 | 2024-02-20 | IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337. |
CVE-2022-48220 | Medium | 6.4 | 2024-02-14 | Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass… |
CVE-2024-25714 | Critical | 9.8 | 2024-02-11 | In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when… |
CVE-2023-6935 | Medium | 5.9 | 2024-02-09 | wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following… |
CVE-2024-25191 | Critical | 9.8 | 2024-02-08 | php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-25190 | Critical | 9.8 | 2024-02-08 | l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-25189 | Critical | 9.8 | 2024-02-08 | libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel. |
CVE-2024-25146 | Medium | 5.3 | 2024-02-08 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported ve… |
CVE-2023-51437 | High | 7.4 | 2024-02-07 | Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signa… |
CVE-2024-0202 | Medium | 5.9 | 2024-02-05 | A security vulnerability has been identified in the cryptlib cryptographic library when cryptlib is compiled with the support for RSA key exchange ciphersuites… |
CVE-2023-50782 | High | 7.5 | 2024-02-05 | A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchan… |
CVE-2023-50781 | High | 7.5 | 2024-02-05 | A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to… |
CVE-2023-6240 | Medium | 6.5 | 2024-02-04 | A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network attacker to decrypt c… |
CVE-2021-21575 | Medium | 5.9 | 2024-02-02 | Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability. |
CVE-2023-5992 | Medium | 5.6 | 2024-01-31 | A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potentia… |
CVE-2024-23170 | Medium | 5.5 | 2024-01-31 | An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could… |
CVE-2024-0914 | Medium | 5.9 | 2024-01-31 | A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS#1 v1.5 padded ciphertexts. This flaw could potent… |
CVE-2023-6258 | High | 8.1 | 2024-01-30 | A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited success… |
CVE-2024-21671 | Low | 3.7 | 2024-01-30 | The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). It is poss… |
CVE-2024-0564 | Medium | 5.3 | 2024-01-30 | A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4… |
CVE-2024-22647 | Medium | 5.3 | 2024-01-30 | An user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user authentication, where a difference in error messages could allow… |
CVE-2024-23218 | Medium | 5.9 | 2024-01-23 | A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPad… |
CVE-2024-23342 | High | 7.4 | 2024-01-23 | The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorith… |
CVE-2024-21484 | High | 7.5 | 2024-01-22 | Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can dec… |
CVE-2024-23771 | Critical | 9.8 | 2024-01-22 | darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypass authentication vi… |
CVE-2024-0553 | High | 7.5 | 2024-01-16 | A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts wit… |
CVE-2023-52323 | Medium | 5.9 | 2024-01-05 | PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. |
CVE-2023-46739 | Medium | 6.5 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that coul… |
CVE-2023-50708 | Medium | 6.1 | 2023-12-22 | yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2… |
CVE-2023-41097 | Medium | 4.6 | 2023-12-21 | An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This i… |
CVE-2023-6135 | Medium | 4.3 | 2023-12-19 | Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private k… |
CVE-2023-23584 | Medium | 4.3 | 2023-12-18 | An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would… |
CVE-2023-50979 | Medium | 5.9 | 2023-12-18 | Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding. |
CVE-2023-4421 | Medium | 6.5 | 2023-12-12 | The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. Both the overall correctness of the padding… |
CVE-2023-45287 | High | 7.5 | 2023-12-05 | Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but… |
CVE-2023-40090 | Medium | 6.5 | 2023-12-04 | In BTM_BleVerifySignature of btm_ble.cc, there is a possible way to bypass signature validation due to side channel information disclosure. This could lead to… |
CVE-2023-49092 | Medium | 5.9 | 2023-11-28 | RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through ti… |
CVE-2023-5981 | Medium | 5.9 | 2023-11-28 | A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct… |
CVE-2023-47102 | Medium | 5.3 | 2023-11-07 | UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid. |
CVE-2023-21354 | Medium | 5.5 | 2023-10-30 | In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclo… |
CVE-2023-21350 | Medium | 5.5 | 2023-10-30 | In Media Projection, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2023-21349 | Low | 3.3 | 2023-10-30 | In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21348 | Low | 3.3 | 2023-10-30 | In Window Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2023-21346 | Low | 3.3 | 2023-10-30 | In the Device Idle Controller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information dis… |
CVE-2023-21345 | Low | 3.3 | 2023-10-30 | In Game Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosur… |
CVE-2023-21344 | Medium | 5.5 | 2023-10-30 | In Job Scheduler, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21338 | Medium | 5.5 | 2023-10-30 | In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21337 | High | 7.8 | 2023-10-30 | In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This c… |
CVE-2023-21336 | Medium | 5.5 | 2023-10-30 | In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21335 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This coul… |
CVE-2023-21333 | Medium | 5.5 | 2023-10-30 | In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21332 | Medium | 5.5 | 2023-10-30 | In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21331 | Medium | 5.5 | 2023-10-30 | In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This c… |
CVE-2023-21330 | Medium | 5.5 | 2023-10-30 | In Overlay Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21327 | Medium | 5.5 | 2023-10-30 | In Permission Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2023-21326 | Medium | 5.5 | 2023-10-30 | In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclo… |
CVE-2023-21325 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This coul… |
CVE-2023-21324 | High | 7.8 | 2023-10-30 | In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2023-21323 | Medium | 5.5 | 2023-10-30 | In Activity Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2023-21320 | Medium | 5.5 | 2023-10-30 | In Device Policy, there is a possible way to verify if a particular admin app is registered on the device due to side channel information disclosure. This coul… |
CVE-2023-21319 | Medium | 5.5 | 2023-10-30 | In UsageStatsService, there is a possible way to read installed 3rd party apps due to side channel information disclosure. This could lead to local information… |
CVE-2023-21318 | Medium | 5.5 | 2023-10-30 | In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21317 | Medium | 5.5 | 2023-10-30 | In ContentService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2023-21316 | Medium | 5.5 | 2023-10-30 | In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21306 | Medium | 5.5 | 2023-10-30 | In ContentService, there is a possible way to read installed sync content providers due to side channel information disclosure. This could lead to local inform… |
CVE-2023-21305 | Medium | 5.5 | 2023-10-30 | In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21304 | Medium | 5.5 | 2023-10-30 | In Content Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21303 | Medium | 5.5 | 2023-10-30 | In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21302 | Medium | 5.5 | 2023-10-30 | In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21301 | Medium | 5.5 | 2023-10-30 | In ActivityManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclos… |
CVE-2023-21300 | Medium | 5.5 | 2023-10-30 | In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2023-21299 | Medium | 5.5 | 2023-10-30 | In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21298 | High | 7.8 | 2023-10-30 | In Slice, there is a possible disclosure of installed applications due to side channel information disclosure. This could lead to local escalation of privilege… |
CVE-2023-21296 | Medium | 5.5 | 2023-10-30 | In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This co… |
CVE-2023-21293 | Medium | 5.5 | 2023-10-30 | In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosur… |