Weaknesses of type CWE-204

190 results

Vazamento de informações através de respostas diferenciadas

A aplicação retorna respostas diferentes (tempo de processamento, mensagens de erro, código HTTP, tamanho da resposta) dependendo do estado interno do sistema, permitindo que atacantes deduzam informações sensíveis sem autorização. Por exemplo, responder com 'usuário não encontrado' versus 'senha incorreta' vaza a existência de contas.

Example

Um formulário de login que retorna 'usuário inexistente' para um email não cadastrado, mas 'credenciais inválidas' quando o email existe, permite que invasores enumerem contas válidas da plataforma sem precisar quebrar senhas.

How to mitigate

Padronize todas as respostas de erro (mensagens e tempo de processamento) para cenários de falha similares. Use mensagens genéricas como 'credenciais inválidas' independente do motivo real, e implemente rate limiting para dificultar enumeração automatizada.

CVE-2026-23511MEDIUMZITADEL has a user enumeration vulnerability in Login UIsEPSS 0.4%CVE-2025-49187MEDIUMUser enumerationEPSS 0.4%CVE-2025-61907HIGHIcinga 2 API users could access restricted values in filter expressionsEPSS 0.4%CVE-2025-9109MEDIUMPortabilis i-Diario Password Recovery Endpoint email observable response discrepancyEPSS 0.4%CVE-2026-19965MEDIUMautomad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancyEPSS 0.4%CVE-2024-39912MEDIUMEnumeration of valid usernames in web-auth/webauthn-libEPSS 0.4%CVE-2025-69413MEDIUMIn Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.EPSS 0.4%CVE-2025-30150MEDIUMShopware 6 allows attackers to check for registered accounts through the store-apiEPSS 0.4%CVE-2025-2910MEDIUMUser enumeration vulnerability in MeetMe productsEPSS 0.4%CVE-2026-60007CRITICALIn Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding aEPSS 0.4%CVE-2024-34336MEDIUMUser enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application byEPSS 0.4%CVE-2024-33856MEDIUMAn issue was discovered in Logpoint before 7.4.0. An attacker can enumerate a valid list of usernames by observing the response time at the EPSS 0.4%CVE-2025-27451MEDIUMCVE-2025-27451EPSS 0.4%CVE-2024-35114MEDIUMIBM Control Center information disclosureEPSS 0.4%CVE-2026-25509MEDIUMCI4MS Vulnerable to User Email Enumeration via Password Reset FlowEPSS 0.4%CVE-2025-0693MEDIUMIssue with AWS Sign-in IAM User Login Flow - Possible Username EnumerationEPSS 0.4%CVE-2025-58586MEDIUMUser Enumeration by excessive error outputEPSS 0.4%CVE-2026-4113HIGHAn observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN usEPSS 0.4%CVE-2026-27480MEDIUMStatic Web Server: Timing-Based Username Enumeration in Basic AuthenticationEPSS 0.4%CVE-2025-46736MEDIUMUmbraco Makes User Enumeration Feasible Based on Timing of Login ResponseEPSS 0.4%