CWE-204 · Observable Response Discrepancy (page 2)
Page 2 of 2 — CVEs classified under CWE-204, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-55198 | Medium | 5.3 | 2025-03-13 | User Enumeration via Discrepancies in Error Messages in the Celk Sistemas Celk Saude v.3.1.252.1 password recovery functionality which allows a remote attacker… |
CVE-2025-24023 | Low | 3.7 | 2025-03-03 | Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timi… |
CVE-2025-1101 | Medium | 5.3 | 2025-02-12 | A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker… |
CVE-2025-23193 | Medium | 5.3 | 2025-02-11 | SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of… |
CVE-2025-24980 | Medium | 5.3 | 2025-02-07 | pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumerat… |
CVE-2023-37413 | Medium | 5.3 | 2025-01-29 | IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy. |
CVE-2023-47159 | Medium | 4.3 | 2025-01-27 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to enumerate usernames due to an observable dis… |
CVE-2024-35114 | Medium | 5.3 | 2025-01-25 | IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts. |
CVE-2025-0693 | Medium | 5.3 | 2025-01-23 | Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an… |
CVE-2025-23214 | | 2025-01-20 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the err… | |
CVE-2024-36510 | Medium | 5.3 | 2025-01-14 | An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7… |
CVE-2024-42174 | Low | 3.7 | 2025-01-11 | HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore comp… |
CVE-2024-13198 | Low | 3.7 | 2025-01-09 | A vulnerability classified as problematic has been found in langhsu Mblog Blog System 3.5.0. Affected is an unknown function of the file /login. The manipulati… |
CVE-2024-13028 | Low | 3.7 | 2024-12-29 | A vulnerability, which was classified as problematic, has been found in Antabot White-Jotter up to 0.2.2. This issue affects some unknown processing of the fil… |
CVE-2024-12663 | Low | 3.7 | 2024-12-16 | A vulnerability classified as problematic was found in funnyzpc Mee-Admin up to 1.6. This vulnerability affects unknown code of the file /mee/login of the comp… |
CVE-2022-20633 | Medium | 5.3 | 2024-11-15 | A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to perform a username enumeration attac… |
CVE-2024-47129 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the length o… |
CVE-2024-41715 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin does not inject extra characters into broadcasted frames to obfuscate the length of messages. This makes it possible to tell the… |
CVE-2024-8651 | Medium | 5.3 | 2024-09-19 | A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which… |
CVE-2024-34336 | Medium | 5.3 | 2024-09-12 | User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the serv… |
CVE-2023-49069 | Medium | 5.3 | 2024-09-10 | A vulnerability has been identified in Mendix Runtime V10 (All versions < V10.17.0 only if the basic authentication mechanism is used by the application), Mend… |
CVE-2024-42343 | Medium | 5.3 | 2024-09-08 | Loway - CWE-204: Observable Response Discrepancy |
CVE-2024-38431 | Medium | 5.3 | 2024-07-30 | Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy |
CVE-2024-40627 | Medium | 5.8 | 2024-07-15 | Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP `OPTIONS` requests are always allowed by `OpaMiddleware`, even when they lack au… |
CVE-2024-39912 | Medium | 5.3 | 2024-07-15 | web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web… |
CVE-2023-33859 | Medium | 5.3 | 2024-07-10 | IBM Security QRadar EDR 3.12 could disclose sensitive information due to an observable login response discrepancy. IBM X-Force ID: 257697. |
CVE-2024-39211 | Medium | 5.3 | 2024-07-04 | Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_email field only if the… |
CVE-2024-36996 | Medium | 5.3 | 2024-07-01 | In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.109, an attacker could determine whether or not… |
CVE-2024-38322 | Medium | 5.3 | 2024-06-28 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration… |
CVE-2024-6056 | Low | 3.7 | 2024-06-17 | A vulnerability was found in nasirkhan Laravel Starter up to 11.8.0. It has been rated as problematic. Affected by this issue is some unknown functionality of… |
CVE-2024-31870 | Low | 3.3 | 2024-06-15 | IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having a… |
CVE-2024-33856 | Medium | 5.3 | 2024-05-07 | An issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the Forgot Password end… |
CVE-2023-27283 | Medium | 5.3 | 2024-05-04 | IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545. |
CVE-2021-20556 | Medium | 5.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 could allow a remote user to enumerate usernames due to differentiating error messages on existing usernames… |
CVE-2024-28232 | Medium | 6.2 | 2024-04-01 | Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vu… |
CVE-2024-28868 | Low | 3.7 | 2024-03-20 | Umbraco is an ASP.NET content management system. Umbraco 10 prior to 10.8.4 with access to the native login screen is vulnerable to a possible user enumeration… |
CVE-2024-1145 | Medium | 5.3 | 2024-03-19 | User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all va… |
CVE-2024-2482 | Low | 3.7 | 2024-03-15 | A vulnerability has been found in Surya2Developer Hostel Management Service 1.0 and classified as problematic. Affected by this vulnerability is an unknown fun… |
CVE-2023-46170 | Medium | 6.5 | 2024-03-07 | IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to arbitrarily read files after enumerating fi… |
CVE-2024-24766 | Medium | 6.2 | 2024-03-06 | CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed… |
CVE-2023-38362 | Medium | 5.3 | 2024-03-04 | IBM CICS TX Advanced 10.1 could disclose sensitive information to a remote attacker due to observable discrepancy in HTTP responses. IBM X-Force ID: 260814. |
CVE-2023-50306 | Medium | 4.0 | 2024-02-20 | IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337. |
CVE-2024-25146 | Medium | 5.3 | 2024-02-08 | Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported ve… |
CVE-2023-23584 | Medium | 4.3 | 2023-12-18 | An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to infer the presence of items that would… |
CVE-2023-37831 | Medium | 5.3 | 2023-10-31 | An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted. |
CVE-2023-4095 | Medium | 5.3 | 2023-09-19 | User enumeration vulnerability in Arconte Áurea 1.5.0.0 version. The exploitation of this vulnerability could allow an attacker to obtain a list of registered… |
CVE-2023-41885 | Medium | 5.3 | 2023-09-12 | Piccolo is an ORM and query builder which supports asyncio. In versions 0.120.0 and prior, the implementation of `BaseUser.login` leaks enough information to a… |
CVE-2023-3221 | Medium | 5.3 | 2023-09-04 | User enumeration vulnerability in Password Recovery plugin 1.2 version for Roundcube, which could allow a remote attacker to create a test script against the p… |
CVE-2023-40179 | Medium | 5.3 | 2023-08-25 | Silverware Games is a premium social network where people can play games online. Prior to version 1.3.6, the Password Recovery form would throw an error if the… |
CVE-2023-39343 | Medium | 4.3 | 2023-08-04 | Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which user (username, email)… |
CVE-2023-37217 | Medium | 5.3 | 2023-07-30 | Tadiran Telecom Aeonix - CWE-204: Observable Response Discrepancy |
CVE-2023-35698 | Medium | 5.3 | 2023-07-10 | Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given durin… |
CVE-2023-3336 | Medium | 5.3 | 2023-07-05 | TN-5900 Series version 3.3 and prior versions is vulnearble to user enumeration vulnerability. The vulnerability may allow a remote attacker to determine wheth… |
CVE-2023-31186 | Medium | 5.3 | 2023-05-30 | Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy |
CVE-2023-28412 | Medium | 5.3 | 2023-05-22 | When supplied with a random MAC address, Snap One OvrC cloud servers will return information about the device. The MAC address of devices can be enume… |
CVE-2023-32346 | Medium | 5.3 | 2023-05-22 | Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices. This function returns information b… |
CVE-2023-23449 | Medium | 5.3 | 2023-05-15 | Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote att… |
CVE-2023-27464 | Medium | 5.3 | 2023-04-11 | A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix 8 compatible) (All… |
CVE-2023-1540 | Medium | 5.3 | 2023-03-21 | Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6. |
CVE-2022-39228 | Medium | 5.3 | 2023-03-01 | vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password co… |
CVE-2019-19030 | Medium | 5.3 | 2022-12-26 | Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP… |
CVE-2022-41697 | Medium | 5.3 | 2022-12-22 | A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure o… |
CVE-2022-39315 | Medium | 6.5 | 2022-10-25 | Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with use… |
CVE-2021-36201 | Medium | 4.3 | 2022-10-11 | Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions. |
CVE-2022-22520 | Medium | 5.3 | 2022-09-14 | A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and H… |
CVE-2022-1989 | Medium | 5.3 | 2022-08-23 | All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to en… |
CVE-2022-31248 | Medium | 5.3 | 2022-06-22 | A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid… |
CVE-2022-0564 | Medium | 5.3 | 2022-02-21 | A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerabil… |
CVE-2021-20049 | High | 7.5 | 2021-12-23 | A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server res… |
CVE-2021-34580 | High | 7.5 | 2021-10-27 | In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted… |
CVE-2021-38476 | Medium | 6.5 | 2021-10-19 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of a username. This m… |
CVE-2021-39189 | Medium | 5.3 | 2021-09-15 | Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password fun… |
CVE-2020-11063 | Low | 3.7 | 2020-05-13 | In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. Th… |
CVE-2016-9499 | Medium | 5.3 | 2018-07-13 | Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this inform… |