Weaknesses of type CWE-203

399 results

Discrepância observável em resposta de erro

A aplicação expõe informações diferentes em suas respostas de erro dependendo de condições internas (ex: usuário existe ou não, senha correta ou não, arquivo encontrado ou não), permitindo que um atacante deduza informações sensíveis através de análise de timing, mensagens ou códigos de status. O risco está em vazar informações que não deveriam ser públicas.

Example

Um endpoint de login retorna 'Usuário não encontrado' quando o email não existe, mas 'Senha incorreta' quando o email existe mas a senha está errada. Um atacante usa essas mensagens para enumerar emails válidos da plataforma sem precisar saber a senha de ninguém.

How to mitigate

Padronize todas as respostas de erro para o mesmo status HTTP e mensagem genérica (ex: sempre 'Credenciais inválidas'). Use timing constante nas verificações criptográficas e operações sensíveis para evitar ataques por timing side-channel.

CVE-2022-34477HIGHThe MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site crosEPSS 0.6%CVE-2025-11443MEDIUMJhumanJ OpnForm Forgotten Password email information exposureEPSS 0.6%CVE-2024-9398MEDIUMBy checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application whiEPSS 0.6%CVE-2024-22647MEDIUMAn user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user authentication, where a difference in error mEPSS 0.6%CVE-2024-50382MEDIUMBotan before 3.6.0, when certain LLVM versions are used, has compiler-induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in EPSS 0.5%CVE-2024-50383MEDIUMBotan before 3.6.0, when certain GCC versions are used, has a compiler-induced secret-dependent operation in lib/utils/donna128.h in donna12EPSS 0.5%CVE-2023-26560MEDIUMNorthern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbEPSS 0.5%CVE-2023-6935MEDIUMMarvin Attack vulnerability in SP Math All RSAEPSS 0.5%CVE-2026-53933MEDIUMMaravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route FuzzingEPSS 0.5%CVE-2026-97782MEDIUMMicrosoft Office SharePoint Tampering VulnerabilityEPSS 0.5%CVE-2024-26268MEDIUMUser enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 2EPSS 0.5%CVE-2025-31124MEDIUMZitadel allows User Enumeration by loginname attribute normalizationEPSS 0.5%CVE-2023-3529MEDIUMRotem Dynamics Rotem CRM OTP URI Interface information exposureEPSS 0.5%CVE-2026-44332MEDIUMFiber: Username Enumeration via Timing Oracle in BasicAuth Default AuthorizerEPSS 0.5%CVE-2023-24598—OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial disclosure of the privEPSS 0.5%CVE-2022-26382MEDIUMWhile the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel atEPSS 0.5%CVE-2023-37482MEDIUMThe login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated reEPSS 0.5%CVE-2026-55555LOWDompdf: File existence oracle via font-face stylesheet declarationEPSS 0.5%CVE-2026-26315MEDIUMGo Ethereum Improperly Validates the ECIES Public Key in RLPx HandshakeEPSS 0.5%CVE-2021-46876MEDIUMAn issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existenceEPSS 0.5%