Weaknesses of type CWE-203

398 results

Discrepância observável em resposta de erro

A aplicação expõe informações diferentes em suas respostas de erro dependendo de condições internas (ex: usuário existe ou não, senha correta ou não, arquivo encontrado ou não), permitindo que um atacante deduza informações sensíveis através de análise de timing, mensagens ou códigos de status. O risco está em vazar informações que não deveriam ser públicas.

Example

Um endpoint de login retorna 'Usuário não encontrado' quando o email não existe, mas 'Senha incorreta' quando o email existe mas a senha está errada. Um atacante usa essas mensagens para enumerar emails válidos da plataforma sem precisar saber a senha de ninguém.

How to mitigate

Padronize todas as respostas de erro para o mesmo status HTTP e mensagem genérica (ex: sempre 'Credenciais inválidas'). Use timing constante nas verificações criptográficas e operações sensíveis para evitar ataques por timing side-channel.

CVE-2026-104415LOWGhost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin APIEPSS 0.2%CVE-2026-106336MEDIUMObservable discrepancy in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTEPSS 0.2%CVE-2026-11795MEDIUMUser Enumeration in Softtr's E-Commerce PackEPSS 0.2%CVE-2026-11289MEDIUMSide-channel information leakage in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a EPSS 0.2%CVE-2026-21386MEDIUMPrivate channel enumeration via /mute slash commandEPSS 0.2%CVE-2026-121223—Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTEPSS 0.2%CVE-2025-8774LOWriscv-boom SonicBOOM L1 Data Cache timing discrepancyEPSS 0.2%CVE-2026-18560MEDIUMImproper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined statusEPSS 0.2%CVE-2023-5410HIGHA potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP isEPSS 0.2%CVE-2026-110141LOWObservable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTEPSS 0.2%CVE-2025-65185LOWThere is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by enteriEPSS 0.2%CVE-2024-8993MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-8994MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47153MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47154MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47155MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2026-4040MEDIUMOpenClaw File Existence tools.exec.safeBins information exposureEPSS 0.2%CVE-2024-8992MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47149LOWSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptiEPSS 0.2%CVE-2024-47156LOWInformation Leak Vulnerability in Honor ProductEPSS 0.1%