Weaknesses of type CWE-203

399 results

Discrepância observável em resposta de erro

A aplicação expõe informações diferentes em suas respostas de erro dependendo de condições internas (ex: usuário existe ou não, senha correta ou não, arquivo encontrado ou não), permitindo que um atacante deduza informações sensíveis através de análise de timing, mensagens ou códigos de status. O risco está em vazar informações que não deveriam ser públicas.

Example

Um endpoint de login retorna 'Usuário não encontrado' quando o email não existe, mas 'Senha incorreta' quando o email existe mas a senha está errada. Um atacante usa essas mensagens para enumerar emails válidos da plataforma sem precisar saber a senha de ninguém.

How to mitigate

Padronize todas as respostas de erro para o mesmo status HTTP e mensagem genérica (ex: sempre 'Credenciais inválidas'). Use timing constante nas verificações criptográficas e operações sensíveis para evitar ataques por timing side-channel.

CVE-2026-118312CRITICALObservable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data viEPSS 0.2%CVE-2026-87539LOWObservable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafteEPSS 0.2%CVE-2025-46804LOWScreen 5.0.0 and older versions allow file existence tests when installed setuid-rootEPSS 0.2%CVE-2026-111933MEDIUMCoder before 2.34.2 User Enumeration via Login Placeholder HashEPSS 0.2%CVE-2026-106180LOWObservable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin datEPSS 0.2%CVE-2026-47011LOWVulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface). Supported versions that are affEPSS 0.2%CVE-2026-118338HIGHObservable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafEPSS 0.2%CVE-2026-88834LOWBusybox: busybox: httpd user existence oracle in non-default shadow-disabled buildsEPSS 0.2%CVE-2026-106506MEDIUMBackstage: Improper input validation in scaffolder task list orderingEPSS 0.2%CVE-2026-106210LOWObservable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a craftedEPSS 0.2%CVE-2026-23620MEDIUMGFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File EnumerationEPSS 0.2%CVE-2025-54999LOWOpenBao: Timing Side-Channel in Userpass Auth MethodEPSS 0.2%CVE-2024-23984MEDIUMObservable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosuEPSS 0.2%CVE-2018-9364HIGHIn the LG LAF component, there is a special command that allowed modification of certain partitions. This could lead to bypass of secure booEPSS 0.2%CVE-2026-106351MEDIUMObservable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the rEPSS 0.2%CVE-2026-106303MEDIUMObservable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proEPSS 0.2%CVE-2026-45294MEDIUMFreeScout: User Account Enumeration via Password Reset Response DifferentiationEPSS 0.2%CVE-2026-103275MEDIUMGhost 5.42.2 before 6.58.0 Password Hash DisclosureEPSS 0.2%CVE-2024-27839MEDIUMA privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 17.5 and iPadOS 17.5. A malicioEPSS 0.2%CVE-2026-45410MEDIUMTime-based user enumeration in TREK authentication endpointEPSS 0.2%