Weaknesses of type CWE-203

399 results

Discrepância observável em resposta de erro

A aplicação expõe informações diferentes em suas respostas de erro dependendo de condições internas (ex: usuário existe ou não, senha correta ou não, arquivo encontrado ou não), permitindo que um atacante deduza informações sensíveis através de análise de timing, mensagens ou códigos de status. O risco está em vazar informações que não deveriam ser públicas.

Example

Um endpoint de login retorna 'Usuário não encontrado' quando o email não existe, mas 'Senha incorreta' quando o email existe mas a senha está errada. Um atacante usa essas mensagens para enumerar emails válidos da plataforma sem precisar saber a senha de ninguém.

How to mitigate

Padronize todas as respostas de erro para o mesmo status HTTP e mensagem genérica (ex: sempre 'Credenciais inválidas'). Use timing constante nas verificações criptográficas e operações sensíveis para evitar ataques por timing side-channel.

CVE-2026-95270MEDIUMdgtlmoon changedetection.io Hash Comparison flask_app.py check_password timing discrepancyEPSS 0.4%CVE-2026-74961CRITICALSide-channel in the Web Audio componentEPSS 0.4%CVE-2025-9109MEDIUMPortabilis i-Diario Password Recovery Endpoint email observable response discrepancyEPSS 0.4%CVE-2024-21206MEDIUMVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Diagnostics). Supported versEPSS 0.4%CVE-2024-12663MEDIUMfunnyzpc Mee-Admin Login login observable response discrepancyEPSS 0.4%CVE-2026-74954HIGHInformation disclosure due to side-channel in the Storage: Cache API componentEPSS 0.4%CVE-2024-28885HIGHObservable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network aEPSS 0.4%CVE-2025-32789LOWEspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting FunctionEPSS 0.4%CVE-2026-47379MEDIUMNocoDB: Plaintext Password Comparison in Shared ViewsEPSS 0.4%CVE-2024-39921HIGHObservable timing discrepancy issue exists in IPCOM EX2 Series V01L02NF0001 to V01L06NF0401, V01L20NF0001 to V01L20NF0401, V02L20NF0001 to VEPSS 0.4%CVE-2026-64822MEDIUMdjangoSIGE 1.10 User Enumeration via ForgotPasswordViewEPSS 0.4%CVE-2024-21233MEDIUMVulnerability in the Oracle Database Core component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21EPSS 0.4%CVE-2026-78617MEDIUMWatchGuard Dimension Web UI Authentication Brute-Force Due to Missing Rate LimitingEPSS 0.4%CVE-2021-47664MEDIUMEnumeration of valid user namesEPSS 0.4%CVE-2026-67193MEDIUMXlight FTP Server < 3.9.5 Information Disclosure via USER CommandEPSS 0.4%CVE-2025-6386HIGHTiming Attack Vulnerability in parisneo/lollmsEPSS 0.4%CVE-2022-24695MEDIUMBluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in NonEPSS 0.4%CVE-2026-59341MEDIUMSealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpointsEPSS 0.4%CVE-2020-36888MEDIUMSpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login ScriptEPSS 0.4%CVE-2024-5697MEDIUMA website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox. This vulnerabilEPSS 0.4%