Fallos del tipo CWE-203

398 resultados

Discrepância Observável em Respostas

A aplicação revela informações sensíveis através de diferenças detectáveis em seu comportamento, tempo de resposta ou mensagens de erro — por exemplo, retornando erros diferentes para usuário inexistente vs. senha incorreta. Um atacante pode explorar essas pistas para inferir dados confidenciais sem acesso direto.

Ejemplo

Um sistema de login que responde 'Usuário não encontrado' em 100ms, mas 'Senha incorreta' em 500ms (após validação). Um invasor enumera contas válidas medindo latência, ou identifica emails registrados pela velocidade da resposta.

Cómo mitigar

Padronize respostas de erro (mesma mensagem genérica), normalize tempos de execução com delays constantes, e evite vazar informações estruturais (ex: 'este email já existe'). Auditoria de logs e timestamps também revelar quem tentou enumerar dados sensíveis.

CVE-2024-47156LOWInformation Leak Vulnerability in Honor ProductEPSS 0.1%CVE-2025-13912LOWPotential non-constant time compiled code with Clang LLVMEPSS 0.1%CVE-2026-28490HIGHAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding OracleEPSS 0.1%CVE-2026-3580LOWCompiler-induced timing leak in sp_256_get_entry_256_9 on RISC-VEPSS 0.1%CVE-2025-48561MEDIUMIn multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure. This couldEPSS 0.1%CVE-2022-20538MEDIUMIn getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query permissions, due toEPSS 0.1%CVE-2022-20559LOWIn revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installed, without query perEPSS 0.1%CVE-2022-20535LOWIn registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to determine whether an app is installed, without queEPSS 0.1%CVE-2023-21337HIGHIn InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informationEPSS 0.1%CVE-2022-20264MEDIUMIn Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel infoEPSS 0.1%CVE-2026-78936LOWObservable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin dEPSS 0.1%CVE-2026-78949LOWObservable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin dEPSS 0.1%CVE-2023-21324HIGHIn Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to side channel inforEPSS 0.1%CVE-2026-56888MEDIUMIn multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalationEPSS 0.1%CVE-2023-21298HIGHIn Slice, there is a possible disclosure of installed applications due to side channel information disclosure. This could lead to local escaEPSS 0.1%CVE-2026-58945MEDIUMIn multiple locations, there is a possible side channel information leak due to improperly used crypto. This could lead to paired device infEPSS 0.1%CVE-2026-65626MEDIUMBleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in joseEPSS 0.1%CVE-2024-43095HIGHIn multiple locations, there is a possible way to obtain any system permission due to a logic error in the code. This could lead to local esEPSS 0.1%