Weaknesses of type CWE-203

399 results

Discrepância observável em resposta de erro

A aplicação expõe informações diferentes em suas respostas de erro dependendo de condições internas (ex: usuário existe ou não, senha correta ou não, arquivo encontrado ou não), permitindo que um atacante deduza informações sensíveis através de análise de timing, mensagens ou códigos de status. O risco está em vazar informações que não deveriam ser públicas.

Example

Um endpoint de login retorna 'Usuário não encontrado' quando o email não existe, mas 'Senha incorreta' quando o email existe mas a senha está errada. Um atacante usa essas mensagens para enumerar emails válidos da plataforma sem precisar saber a senha de ninguém.

How to mitigate

Padronize todas as respostas de erro para o mesmo status HTTP e mensagem genérica (ex: sempre 'Credenciais inválidas'). Use timing constante nas verificações criptográficas e operações sensíveis para evitar ataques por timing side-channel.

CVE-2024-5697MEDIUMA website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox. This vulnerabilEPSS 0.4%CVE-2020-10367MEDIUMCertain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra"EPSS 0.4%CVE-2020-10369MEDIUMCertain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory conteEPSS 0.4%CVE-2026-65314MEDIUMElectric Postgres Sync Excluded-Column Value Inference via Subset Where ClausesEPSS 0.4%CVE-2025-57770MEDIUMZITADEL user enumeration vulnerability in login UIEPSS 0.4%CVE-2026-114064MEDIUMSnipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing EndpointEPSS 0.4%CVE-2026-26185MEDIUMDirectus Affected by User Enumeration via Password Reset Timing AttackEPSS 0.4%CVE-2024-21251LOWVulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4EPSS 0.4%CVE-2025-6011LOWTiming Side-Channel in Vault’s Userpass Auth MethodEPSS 0.4%CVE-2024-30176MEDIUMIn Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets.EPSS 0.4%CVE-2024-54454MEDIUMAn issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. An Observable REPSS 0.4%CVE-2024-30257LOW1Panel's password verification is suspected to have a timing attack vulnerabilityEPSS 0.4%CVE-2023-30308MEDIUMAn issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hijack TCP sessions whicEPSS 0.4%CVE-2026-113314HIGHObservable discrepancy in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak cross-origin data via EPSS 0.4%CVE-2026-23937MEDIUMHost PSK extraction in Zabbix APIEPSS 0.4%CVE-2025-6056MEDIUMTiming difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackeEPSS 0.4%CVE-2025-10890CRITICALSide-channel information leakage in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to leak cross-origin data via a crEPSS 0.4%CVE-2026-113197HIGHObservable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain seEPSS 0.4%CVE-2026-113331HIGHObservable discrepancy in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtainEPSS 0.4%CVE-2026-113167HIGHObservable discrepancy in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted EPSS 0.4%