Weaknesses of type CWE-203

350 results

Discrepância observável em resposta de erro

A aplicação expõe informações diferentes em suas respostas de erro dependendo de condições internas (ex: usuário existe ou não, senha correta ou não, arquivo encontrado ou não), permitindo que um atacante deduza informações sensíveis através de análise de timing, mensagens ou códigos de status. O risco está em vazar informações que não deveriam ser públicas.

Example

Um endpoint de login retorna 'Usuário não encontrado' quando o email não existe, mas 'Senha incorreta' quando o email existe mas a senha está errada. Um atacante usa essas mensagens para enumerar emails válidos da plataforma sem precisar saber a senha de ninguém.

How to mitigate

Padronize todas as respostas de erro para o mesmo status HTTP e mensagem genérica (ex: sempre 'Credenciais inválidas'). Use timing constante nas verificações criptográficas e operações sensíveis para evitar ataques por timing side-channel.

CVE-2026-21386MEDIUMPrivate channel enumeration via /mute slash commandEPSS 0.2%CVE-2023-5410HIGHA potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP isEPSS 0.2%CVE-2025-13736LOWUsername Enumeration via Login Interface in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%CVE-2025-8774LOWriscv-boom SonicBOOM L1 Data Cache timing discrepancyEPSS 0.2%CVE-2025-65185LOWThere is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by enteriEPSS 0.2%CVE-2024-8994MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47153MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-8993MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47155MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47154MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-8992MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47150LOWSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.1%CVE-2024-47156LOWInformation Leak Vulnerability in Honor ProductEPSS 0.1%CVE-2024-47149LOWSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptiEPSS 0.1%CVE-2025-13912LOWPotential non-constant time compiled code with Clang LLVMEPSS 0.1%CVE-2026-28490HIGHAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding OracleEPSS 0.1%CVE-2026-4040MEDIUMOpenClaw File Existence tools.exec.safeBins information exposureEPSS 0.1%CVE-2026-3580LOWCompiler-induced timing leak in sp_256_get_entry_256_9 on RISC-VEPSS 0.1%CVE-2025-48561MEDIUMIn multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure. This couldEPSS 0.1%CVE-2022-20538MEDIUMIn getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query permissions, due toEPSS 0.1%