Weaknesses of type CWE-203

399 results

Discrepância observável em resposta de erro

A aplicação expõe informações diferentes em suas respostas de erro dependendo de condições internas (ex: usuário existe ou não, senha correta ou não, arquivo encontrado ou não), permitindo que um atacante deduza informações sensíveis através de análise de timing, mensagens ou códigos de status. O risco está em vazar informações que não deveriam ser públicas.

Example

Um endpoint de login retorna 'Usuário não encontrado' quando o email não existe, mas 'Senha incorreta' quando o email existe mas a senha está errada. Um atacante usa essas mensagens para enumerar emails válidos da plataforma sem precisar saber a senha de ninguém.

How to mitigate

Padronize todas as respostas de erro para o mesmo status HTTP e mensagem genérica (ex: sempre 'Credenciais inválidas'). Use timing constante nas verificações criptográficas e operações sensíveis para evitar ataques por timing side-channel.

CVE-2026-113167HIGHObservable discrepancy in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted EPSS 0.4%CVE-2022-50800MEDIUMH3C SSL VPN n/a Username Enumeration via Login Script Credential VerificationEPSS 0.4%CVE-2026-58445LOWCross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APIEPSS 0.4%CVE-2026-103272HIGHGhost 2.10.0 before 6.63.0 Staff Enumeration via Content APIEPSS 0.4%CVE-2021-34576MEDIUMObservable discrepancy in Kaden PICOFLUX AiR leaks water consumptionEPSS 0.4%CVE-2026-26895MEDIUMUser enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the plEPSS 0.4%CVE-2026-56339HIGHCapgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPCEPSS 0.4%CVE-2026-37064MEDIUMUser enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the appEPSS 0.4%CVE-2025-52576MEDIUMKanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection BypassEPSS 0.4%CVE-2023-38327MEDIUMAn issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unautEPSS 0.4%CVE-2023-53943MEDIUMGLPI 9.5.7 Username Enumeration Vulnerability via Lost Password EndpointEPSS 0.4%CVE-2023-46739MEDIUMTiming attack can leak user passwordsEPSS 0.4%CVE-2024-1544MEDIUMECDSA nonce bias caused by truncationEPSS 0.3%CVE-2025-64749MEDIUMDirectus Vulnerable to Information Leakage in Existing CollectionsEPSS 0.3%CVE-2026-113056CRITICALObservable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a EPSS 0.3%CVE-2026-112992CRITICALObservable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HEPSS 0.3%CVE-2026-59640HIGHOpenPGP CFB quick-check oracle active on symmetric/session-key pathsEPSS 0.3%CVE-2026-72632HIGHObservable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API KeysEPSS 0.3%CVE-2025-40732HIGHUser enumeration vulnerability in Daily Expense ManagerEPSS 0.3%CVE-2026-103021MEDIUMOpenEMR: Username Enumeration via Pre-Authentication User Settings LoadingEPSS 0.3%