Fallos del tipo CWE-203

398 resultados

Discrepância Observável em Respostas

A aplicação revela informações sensíveis através de diferenças detectáveis em seu comportamento, tempo de resposta ou mensagens de erro — por exemplo, retornando erros diferentes para usuário inexistente vs. senha incorreta. Um atacante pode explorar essas pistas para inferir dados confidenciais sem acesso direto.

Ejemplo

Um sistema de login que responde 'Usuário não encontrado' em 100ms, mas 'Senha incorreta' em 500ms (após validação). Um invasor enumera contas válidas medindo latência, ou identifica emails registrados pela velocidade da resposta.

Cómo mitigar

Padronize respostas de erro (mesma mensagem genérica), normalize tempos de execução com delays constantes, e evite vazar informações estruturais (ex: 'este email já existe'). Auditoria de logs e timestamps também revelar quem tentou enumerar dados sensíveis.

CVE-2026-104415LOWGhost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin APIEPSS 0.2%CVE-2026-106336MEDIUMObservable discrepancy in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTEPSS 0.2%CVE-2026-11795MEDIUMUser Enumeration in Softtr's E-Commerce PackEPSS 0.2%CVE-2026-11289MEDIUMSide-channel information leakage in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a EPSS 0.2%CVE-2026-21386MEDIUMPrivate channel enumeration via /mute slash commandEPSS 0.2%CVE-2026-121223—Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTEPSS 0.2%CVE-2025-8774LOWriscv-boom SonicBOOM L1 Data Cache timing discrepancyEPSS 0.2%CVE-2026-18560MEDIUMImproper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined statusEPSS 0.2%CVE-2023-5410HIGHA potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP isEPSS 0.2%CVE-2026-110141LOWObservable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTEPSS 0.2%CVE-2025-65185LOWThere is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by enteriEPSS 0.2%CVE-2024-8993MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47153MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-8994MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47155MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47154MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2026-4040MEDIUMOpenClaw File Existence tools.exec.safeBins information exposureEPSS 0.2%CVE-2024-8992MEDIUMSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.2%CVE-2024-47149LOWSome Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptiEPSS 0.2%CVE-2024-47150LOWSome Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.EPSS 0.1%