Fallos del tipo CWE-208

212 resultados

Discrepância de Tempo Observável

A fraqueza ocorre quando o tempo de execução de uma operação sensível (como validação de senha, verificação de token ou decisão criptográfica) varia dependendo do resultado, permitindo um atacante inferir informações pela duração da resposta. Diferenças de milissegundos podem revelar se um palpite estava correto.

Ejemplo

Um sistema valida senha comparando string por string: se o primeiro caractere estiver errado, retorna erro imediatamente; se estiver certo, continua comparando o segundo. Um atacante mede o tempo de resposta e deduz o padrão correto caractere por caractere, sem precisar da senha correta.

Cómo mitigar

Use funções de comparação constante (ex: `crypto.timingSafeEqual()` em Node.js ou `hmac_equals()` em PHP) que levam o mesmo tempo independente do ponto de falha. Para operações complexas, adicione delays aleatórios ou processe sempre a operação completa antes de retornar resultado.

CVE-2026-77987CRITICALGitHub Enterprise Server notebook viewer vulnerable to Server-side request forgeryEPSS 0.9%CVE-2022-39308MEDIUMGoCD API authentication of user access tokens subject to timing attack during comparisonEPSS 0.9%CVE-2022-29185MEDIUMObservable Timing Discrepancy in totp-rsEPSS 0.9%CVE-2025-13473MEDIUMUsername enumeration through timing difference in mod_wsgi authentication handlerEPSS 0.8%CVE-2023-40021MEDIUMTiming Attack Reveals CSRF Tokens in oppiaEPSS 0.8%CVE-2014-125055LOWagnivade easy-scrypt scrypt.go VerifyPassphrase timing discrepancyEPSS 0.7%CVE-2013-10006LOWZiftr primecoin bitcoinrpc.cpp HTTPAuthorized timing discrepancyEPSS 0.7%CVE-2023-24035LOWAn issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function uses a insecure timing comparison that leadsEPSS 0.7%CVE-2014-125056LOWPylons horus services.py timing discrepancyEPSS 0.7%CVE-2021-4294LOWOpenShift OSIN CheckClientSecret timing discrepancyEPSS 0.7%CVE-2025-59432MEDIUMTiming Attack Vulnerability in SCRAM AuthenticationEPSS 0.7%CVE-2022-4823LOWInSTEDD Nuntium geopoll_controller.rb timing discrepancyEPSS 0.7%CVE-2026-8794MEDIUMPaperCut NG/MF: User enumeration via timing attackEPSS 0.7%CVE-2016-15015LOWviafintech Barzahlen Payment Module PHP SDK Webhook.php verify timing discrepancyEPSS 0.7%CVE-2023-1538MEDIUMObservable Timing Discrepancy in answerdev/answerEPSS 0.6%CVE-2026-63132CRITICALOpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackEPSS 0.6%CVE-2021-42016HIGHA vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUEPSS 0.6%CVE-2026-77582MEDIUMTinyauth: User enumeration attack by timing oracleEPSS 0.6%CVE-2023-25529HIGHNVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of EPSS 0.6%CVE-2024-42368MEDIUMopen-telemetry has an Observable Timing DiscrepancyEPSS 0.6%