Weaknesses of type CWE-203

399 results

Discrepância observável em resposta de erro

A aplicação expõe informações diferentes em suas respostas de erro dependendo de condições internas (ex: usuário existe ou não, senha correta ou não, arquivo encontrado ou não), permitindo que um atacante deduza informações sensíveis através de análise de timing, mensagens ou códigos de status. O risco está em vazar informações que não deveriam ser públicas.

Example

Um endpoint de login retorna 'Usuário não encontrado' quando o email não existe, mas 'Senha incorreta' quando o email existe mas a senha está errada. Um atacante usa essas mensagens para enumerar emails válidos da plataforma sem precisar saber a senha de ninguém.

How to mitigate

Padronize todas as respostas de erro para o mesmo status HTTP e mensagem genérica (ex: sempre 'Credenciais inválidas'). Use timing constante nas verificações criptográficas e operações sensíveis para evitar ataques por timing side-channel.

CVE-2026-72699CRITICALGrav Login Plugin before 3.9.1 Email Enumeration via RegistrationEPSS 0.3%CVE-2025-24506MEDIUMA specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.EPSS 0.3%CVE-2021-33149MEDIUMObservable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via EPSS 0.3%CVE-2025-1396LOWUsername Enumeration in Multiple WSO2 Products with Multi-Attribute Login EnabledEPSS 0.3%CVE-2024-38465MEDIUMShenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus erroEPSS 0.3%CVE-2026-121138MEDIUMObservable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HEPSS 0.2%CVE-2026-114199MEDIUMGitea contribution heatmap private activity disclosure to public-only tokensEPSS 0.2%CVE-2022-46724LOWThis issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.4 and iPadOS 16.4. A person with pEPSS 0.2%CVE-2026-109337MEDIUMSurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE ClauseEPSS 0.2%CVE-2025-68164LOWIn JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection testEPSS 0.2%CVE-2025-9031MEDIUMTiming-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive WebEPSS 0.2%CVE-2024-50102MEDIUMx86: fix user address masking non-canonical speculation issueEPSS 0.2%CVE-2023-27931MEDIUMThis issue was addressed by removing the vulnerable code. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.3, iOS 16.4 and iPaEPSS 0.2%CVE-2026-11284MEDIUMSide-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin dEPSS 0.2%CVE-2026-91714MEDIUMObservable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensEPSS 0.2%CVE-2026-91725MEDIUMObservable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted EPSS 0.2%CVE-2022-42792—This issue was addressed with improved data protection. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to read sensitive EPSS 0.2%CVE-2025-36225MEDIUMIBM Aspera Faspex information disclosureEPSS 0.2%CVE-2022-0823MEDIUMAn improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the passworEPSS 0.2%CVE-2025-29780MEDIUMPost-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix OperationsEPSS 0.2%