Weaknesses of type CWE-203

399 results

Discrepância observável em resposta de erro

A aplicação expõe informações diferentes em suas respostas de erro dependendo de condições internas (ex: usuário existe ou não, senha correta ou não, arquivo encontrado ou não), permitindo que um atacante deduza informações sensíveis através de análise de timing, mensagens ou códigos de status. O risco está em vazar informações que não deveriam ser públicas.

Example

Um endpoint de login retorna 'Usuário não encontrado' quando o email não existe, mas 'Senha incorreta' quando o email existe mas a senha está errada. Um atacante usa essas mensagens para enumerar emails válidos da plataforma sem precisar saber a senha de ninguém.

How to mitigate

Padronize todas as respostas de erro para o mesmo status HTTP e mensagem genérica (ex: sempre 'Credenciais inválidas'). Use timing constante nas verificações criptográficas e operações sensíveis para evitar ataques por timing side-channel.

CVE-2025-11145HIGHUser Enumeration in CBK Soft's enVisionEPSS 0.3%CVE-2026-73630MEDIUMSiYuan before v3.7.4 Information Disclosure via authFilePublishAccessEPSS 0.3%CVE-2023-32694MEDIUMNon-constant time HMAC comparison in Adyen plugin in SaleorEPSS 0.3%CVE-2024-41880MEDIUMIn veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and pEPSS 0.3%CVE-2026-44263MEDIUMWeblate: Private Translation Enumeration via Screenshot APIEPSS 0.3%CVE-2025-0361MEDIUMDuring an annual penetration test conducted on behalf of Axis Communications, Truesec discovered a flaw in the VAPIX Device Configuration frEPSS 0.3%CVE-2026-56327MEDIUMCapgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPCEPSS 0.3%CVE-2026-113203HIGHObservable discrepancy in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafteEPSS 0.3%CVE-2026-112995HIGHObservable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a EPSS 0.3%CVE-2025-56423MEDIUMAn issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attacker to obtain sensitEPSS 0.3%CVE-2025-59702HIGHEntrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physiEPSS 0.3%CVE-2025-47872MEDIUMEG4 Electronics EG4 Inverters Observable DiscrepancyEPSS 0.3%CVE-2025-5802MEDIUMUsername Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.3%CVE-2026-59502MEDIUMPriority - CWE-203: Observable DiscrepancyEPSS 0.3%CVE-2026-11754MEDIUMUser Enumeration in Seres Software's syWEBEPSS 0.3%CVE-2026-4045MEDIUMprojectsend Auth.php response discrepancyEPSS 0.3%CVE-2026-33429MEDIUMParse Server: Protected field change detection oracle via LiveQuery watch parameterEPSS 0.3%CVE-2024-45678MEDIUMYubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extracEPSS 0.3%CVE-2024-47057MEDIUMUser name enumeration possible due to response time difference on password reset formEPSS 0.3%CVE-2026-55227MEDIUMObservable object existence disclosure in private Weblate projects via globally scoped object lookupsEPSS 0.3%