CWE-203 · Observable Discrepancy (page 4)
Page 4 of 8 — CVEs classified under CWE-203, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47102 | Medium | 5.3 | 2023-11-07 | UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid. |
CVE-2023-21354 | Medium | 5.5 | 2023-10-30 | In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclo… |
CVE-2023-21350 | Medium | 5.5 | 2023-10-30 | In Media Projection, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2023-21349 | Low | 3.3 | 2023-10-30 | In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21348 | Low | 3.3 | 2023-10-30 | In Window Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2023-21346 | Low | 3.3 | 2023-10-30 | In the Device Idle Controller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information dis… |
CVE-2023-21345 | Low | 3.3 | 2023-10-30 | In Game Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosur… |
CVE-2023-21344 | Medium | 5.5 | 2023-10-30 | In Job Scheduler, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21338 | Medium | 5.5 | 2023-10-30 | In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21337 | High | 7.8 | 2023-10-30 | In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This c… |
CVE-2023-21336 | Medium | 5.5 | 2023-10-30 | In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21335 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This coul… |
CVE-2023-21333 | Medium | 5.5 | 2023-10-30 | In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21332 | Medium | 5.5 | 2023-10-30 | In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2023-21331 | Medium | 5.5 | 2023-10-30 | In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This c… |
CVE-2023-21330 | Medium | 5.5 | 2023-10-30 | In Overlay Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21327 | Medium | 5.5 | 2023-10-30 | In Permission Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2023-21326 | Medium | 5.5 | 2023-10-30 | In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclo… |
CVE-2023-21325 | Medium | 5.5 | 2023-10-30 | In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This coul… |
CVE-2023-21324 | High | 7.8 | 2023-10-30 | In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2023-21323 | Medium | 5.5 | 2023-10-30 | In Activity Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2023-21320 | Medium | 5.5 | 2023-10-30 | In Device Policy, there is a possible way to verify if a particular admin app is registered on the device due to side channel information disclosure. This coul… |
CVE-2023-21319 | Medium | 5.5 | 2023-10-30 | In UsageStatsService, there is a possible way to read installed 3rd party apps due to side channel information disclosure. This could lead to local information… |
CVE-2023-21318 | Medium | 5.5 | 2023-10-30 | In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21317 | Medium | 5.5 | 2023-10-30 | In ContentService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2023-21316 | Medium | 5.5 | 2023-10-30 | In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21306 | Medium | 5.5 | 2023-10-30 | In ContentService, there is a possible way to read installed sync content providers due to side channel information disclosure. This could lead to local inform… |
CVE-2023-21305 | Medium | 5.5 | 2023-10-30 | In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21304 | Medium | 5.5 | 2023-10-30 | In Content Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21303 | Medium | 5.5 | 2023-10-30 | In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2023-21302 | Medium | 5.5 | 2023-10-30 | In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21301 | Medium | 5.5 | 2023-10-30 | In ActivityManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclos… |
CVE-2023-21300 | Medium | 5.5 | 2023-10-30 | In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2023-21299 | Medium | 5.5 | 2023-10-30 | In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2023-21298 | High | 7.8 | 2023-10-30 | In Slice, there is a possible disclosure of installed applications due to side channel information disclosure. This could lead to local escalation of privilege… |
CVE-2023-21296 | Medium | 5.5 | 2023-10-30 | In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This co… |
CVE-2023-21293 | Medium | 5.5 | 2023-10-30 | In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosur… |
CVE-2022-20264 | Medium | 5.5 | 2023-10-30 | In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel information disclosure… |
CVE-2023-5722 | Medium | 5.3 | 2023-10-25 | Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header. This vulnerabi… |
CVE-2022-25332 | Medium | 4.4 | 2023-10-19 | The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by… |
CVE-2023-36127 | High | 7.5 | 2023-10-10 | User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. This issue occurs during password recovery, where a difference in messages could allow an… |
CVE-2023-43623 | Medium | 5.3 | 2023-10-10 | A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions < V5.4.0), Mendix Forgot Password (Mendix 7 compatible) (All… |
CVE-2023-38871 | Medium | 5.3 | 2023-09-28 | The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. Th… |
CVE-2023-44216 | Medium | 5.3 | 2023-09-27 | PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing at… |
CVE-2023-25529 | High | 8.0 | 2023-09-20 | NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of another user’s sess… |
CVE-2023-4095 | Medium | 5.3 | 2023-09-19 | User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered… |
CVE-2023-41885 | Medium | 5.3 | 2023-09-12 | Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a… |
CVE-2023-3221 | Medium | 5.3 | 2023-09-04 | User enumeration vulnerability in Password Recovery plugin 1.2 version for Roundcube, which could allow a remote attacker to create a test script against the p… |
CVE-2023-39522 | Medium | 5.3 | 2023-08-29 | goauthentik is an open-source Identity Provider. In affected versions using a recovery flow with an identification stage an attacker is able to determine if a… |
CVE-2023-40756 | Critical | 9.8 | 2023-08-28 | User enumeration is found in PHPJabbers Callback Widget v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacke… |
CVE-2023-33850 | High | 7.5 | 2023-08-22 | IBM GSKit-Crypto could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By… |
CVE-2023-40021 | Medium | 5.3 | 2023-08-16 | Oppia is an online learning platform. When comparing a received CSRF token against the expected token, Oppia uses the string equality operator (`==`), which is… |
CVE-2023-40343 | Medium | 5.9 | 2023-08-16 | Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token allowing attackers… |
CVE-2022-46724 | Low | 2.4 | 2023-08-14 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.4 and iPadOS 16.4. A person with physical access to a… |
CVE-2022-40982 | Medium | 6.5 | 2023-08-11 | Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an aut… |
CVE-2023-20569 | Medium | 4.7 | 2023-08-08 | A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execut… |
CVE-2023-20583 | Medium | 4.7 | 2023-08-01 | A potential power side-channel vulnerability in AMD processors may allow an authenticated attacker to monitor the CPU power consumption as the data in a cache… |
CVE-2023-3462 | Medium | 5.3 | 2023-07-31 | HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-… |
CVE-2023-37217 | Medium | 5.3 | 2023-07-30 | Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy |
CVE-2023-3897 | Medium | 4.8 | 2023-07-25 | Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user informa… |
CVE-2023-3640 | High | 7.0 | 2023-07-24 | A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the locatio… |
CVE-2023-34669 | High | 7.5 | 2023-07-17 | TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system. |
CVE-2023-20575 | Medium | 6.5 | 2023-07-11 | A potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a… |
CVE-2023-35698 | Medium | 5.3 | 2023-07-10 | Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given durin… |
CVE-2023-3529 | Medium | 5.3 | 2023-07-06 | A vulnerability classified as problematic has been found in Rotem Dynamics Rotem CRM up to 20230729. This affects an unknown part of the file /LandingPages/api… |
CVE-2023-3336 | Medium | 5.3 | 2023-07-05 | TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine wheth… |
CVE-2023-37305 | Medium | 5.3 | 2023-06-30 | An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/… |
CVE-2023-22359 | Medium | 4.3 | 2023-06-26 | User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames. |
CVE-2022-42792 | Medium | 5.5 | 2023-06-23 | This issue was addressed with improved data protection. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to read sensitive location information |
CVE-2023-34878 | High | 7.5 | 2023-06-14 | An issue was discovered in Ujcms v6.0.2 allows attackers to gain sensitive information via the dir parameter to /api/backend/core/web-file-html/download-zip. |
CVE-2023-1707 | High | 7.5 | 2023-06-13 | Certain HP Enterprise LaserJet and HP LaserJet Managed Printers are potentially vulnerable to information disclosure when IPsec is enabled with FutureSmart ver… |
CVE-2023-34344 | Medium | 5.3 | 2023-06-12 | AMI BMC contains a vulnerability in the IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid username, which may lead to infor… |
CVE-2023-33518 | Medium | 5.3 | 2023-06-05 | emoncms v11 and later was discovered to contain an information disclosure vulnerability which allows attackers to obtain the web directory path and other infor… |
CVE-2023-25741 | Medium | 6.5 | 2023-06-02 | When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipped in 109 and caused web compatibility p… |
CVE-2023-25728 | Medium | 6.5 | 2023-06-02 | The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe t… |
CVE-2022-24695 | Medium | 4.3 | 2023-06-02 | Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non-Discoverable mode… |
CVE-2023-33741 | High | 7.5 | 2023-05-30 | Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device. |
CVE-2023-32342 | High | 7.5 | 2023-05-30 | IBM GSKit could allow a remote attacker to obtain sensitive information, caused by a timing-based side channel in the RSA Decryption implementation. By sending… |
CVE-2023-31186 | Medium | 5.3 | 2023-05-30 | Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy |
CVE-2023-32691 | Medium | 5.9 | 2023-05-30 | gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-… |
CVE-2023-24598 | Medium | 4.3 | 2023-05-29 | OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the private contacts of ano… |
CVE-2023-26215 | High | 7.7 | 2023-05-25 | The server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that allows an attacker with low-privileged application access to rea… |
CVE-2023-32694 | Medium | 4.8 | 2023-05-25 | Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse th… |
CVE-2023-28015 | Medium | 5.3 | 2023-05-23 | The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability. During a failed login attempt a difference in messages cou… |
CVE-2023-28412 | Medium | 5.3 | 2023-05-22 | When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enume… |
CVE-2023-1696 | High | 7.5 | 2023-05-20 | The multimedia video module has a vulnerability in data processing.Successful exploitation of this vulnerability may affect availability. |
CVE-2023-23449 | Medium | 5.3 | 2023-05-15 | Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote att… |
CVE-2023-27870 | Medium | 5.9 | 2023-05-11 | IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IB… |
CVE-2023-28200 | Medium | 5.5 | 2023-05-08 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6… |
CVE-2023-27931 | Medium | 5.5 | 2023-05-08 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.3, iOS 16.4 and iPadOS 16.4, macOS Big… |
CVE-2023-28770 | High | 7.5 | 2023-04-27 | The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 co… |
CVE-2023-26560 | Medium | 6.5 | 2023-04-26 | Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and po… |
CVE-2022-40482 | Medium | 5.3 | 2023-04-25 | The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2… |
CVE-2023-30458 | Medium | 5.3 | 2023-04-24 | A username enumeration issue was discovered in Medicine Tracker System 1.0. The login functionality allows a malicious user to guess a valid username due to a… |
CVE-2023-26557 | High | 7.5 | 2023-04-21 | io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not consta… |
CVE-2023-26556 | Critical | 9.1 | 2023-04-21 | io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypt… |
CVE-2023-1998 | Medium | 5.6 | 2023-04-21 | The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well… |
CVE-2022-34125 | Medium | 6.5 | 2023-04-16 | front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file par… |
CVE-2023-29850 | High | 7.5 | 2023-04-14 | SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images. This allows attackers to obtain information such as the… |
CVE-2023-27464 | Medium | 5.3 | 2023-04-11 | A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All… |