Weaknesses of type CWE-203

399 results

Discrepância observável em resposta de erro

A aplicação expõe informações diferentes em suas respostas de erro dependendo de condições internas (ex: usuário existe ou não, senha correta ou não, arquivo encontrado ou não), permitindo que um atacante deduza informações sensíveis através de análise de timing, mensagens ou códigos de status. O risco está em vazar informações que não deveriam ser públicas.

Example

Um endpoint de login retorna 'Usuário não encontrado' quando o email não existe, mas 'Senha incorreta' quando o email existe mas a senha está errada. Um atacante usa essas mensagens para enumerar emails válidos da plataforma sem precisar saber a senha de ninguém.

How to mitigate

Padronize todas as respostas de erro para o mesmo status HTTP e mensagem genérica (ex: sempre 'Credenciais inválidas'). Use timing constante nas verificações criptográficas e operações sensíveis para evitar ataques por timing side-channel.

CVE-2026-84461MEDIUMZammad: Missing rate limiting allows password brute-forcing during two-factor loginEPSS 0.3%CVE-2026-56098MEDIUMRubygem-katello: improper authorization logic allows resource enumerationEPSS 0.3%CVE-2026-25562MEDIUMWeKan < 8.19 Attachments Publication Information DisclosureEPSS 0.3%CVE-2026-76406MEDIUMInformation Disclosure through REST API Authentication in Splunk SOAREPSS 0.3%CVE-2026-73409MEDIUMBudibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFileEPSS 0.3%CVE-2026-87459MEDIUMObservable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a craEPSS 0.3%CVE-2026-87623MEDIUMObservable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensEPSS 0.3%CVE-2026-87478MEDIUMObservable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a cEPSS 0.3%CVE-2026-78955MEDIUMObservable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origEPSS 0.3%CVE-2026-87620MEDIUMObservable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafteEPSS 0.3%CVE-2023-5872MEDIUMWago: Vulnerability in Smart Designer Web-ApplicationEPSS 0.3%CVE-2023-28200MEDIUMA validation issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.3, iOS 15.7.4 and iPadOS 15.7.4, EPSS 0.3%CVE-2024-51477MEDIUMIBM InfoSphere Information Server information disclosureEPSS 0.3%CVE-2026-56316MEDIUMCap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*EPSS 0.3%CVE-2026-23931MEDIUMFrontend plaintext macro value enumeration via the validatate.api.exists actionEPSS 0.3%CVE-2026-56296MEDIUMCap-go - App Existence Oracle via Unauthenticated transfer_app RPCEPSS 0.3%CVE-2024-54002MEDIUMDependency-Track allows enumeration of managed users via /api/v1/user/login endpointEPSS 0.3%CVE-2026-104416HIGHGhost 4.39.0 before 6.64.0 Invite Token Disclosure via Admin APIEPSS 0.3%CVE-2025-12888LOWConstant Time Issue with Xtensa-based ESP32 and X22519EPSS 0.3%CVE-2026-56319MEDIUMCapgo - App Existence Oracle via GET /statistics/app/:app_idEPSS 0.3%