Fallos del tipo CWE-208

192 resultados

Discrepância de Tempo Observável

A fraqueza ocorre quando o tempo de execução de uma operação sensível (como validação de senha, verificação de token ou decisão criptográfica) varia dependendo do resultado, permitindo um atacante inferir informações pela duração da resposta. Diferenças de milissegundos podem revelar se um palpite estava correto.

Ejemplo

Um sistema valida senha comparando string por string: se o primeiro caractere estiver errado, retorna erro imediatamente; se estiver certo, continua comparando o segundo. Um atacante mede o tempo de resposta e deduz o padrão correto caractere por caractere, sem precisar da senha correta.

Cómo mitigar

Use funções de comparação constante (ex: `crypto.timingSafeEqual()` em Node.js ou `hmac_equals()` em PHP) que levam o mesmo tempo independente do ponto de falha. Para operações complexas, adicione delays aleatórios ou processe sempre a operação completa antes de retornar resultado.

CVE-2021-26318—Side-channels Related to the x86 PREFETCH InstructionEPSS 0.3%CVE-2024-36469LOWUser enumeration via timing attack in Zabbix web interfaceEPSS 0.3%CVE-2026-9537MEDIUMMojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparisonEPSS 0.3%CVE-2026-32702MEDIUMCleanuparr has Username Enumeration via Timing AttackEPSS 0.3%CVE-2026-54411MEDIUMLinux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password ComparisonEPSS 0.3%CVE-2026-13183HIGHRadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.3%CVE-2017-20240MEDIUMCrypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacksEPSS 0.3%CVE-2026-33129MEDIUMh3 has an observable timing discrepancy in basic auth utilsEPSS 0.3%CVE-2025-30344MEDIUMAn issue was discovered in OpenSlides before 4.2.5. During login at the /system/auth/login/ endpoint, the system's response times differ depEPSS 0.3%CVE-2026-47380MEDIUMNocoDB: User Enumeration via Sign-In TimingEPSS 0.3%CVE-2024-41741MEDIUMIBM TXSeries for Multiplatforms information disclosureEPSS 0.3%CVE-2026-44368MEDIUMPyQuorum: Timing side‑channel in mul_modEPSS 0.3%CVE-2024-0202MEDIUMCryptlib: rsa key exchange ciphersuites in tls vulnerable to marvin attackEPSS 0.3%CVE-2021-31403MEDIUMTiming side channel vulnerability in UIDL request handler in Vaadin 7 and 8EPSS 0.3%CVE-2026-16037HIGHCallback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS ModuleEPSS 0.3%CVE-2021-34337MEDIUMAn issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the valuEPSS 0.3%CVE-2023-41097MEDIUMPotential Timing vulnerability in CBC PKCS7 padding calculationsEPSS 0.3%CVE-2026-23996LOWFastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detectionEPSS 0.3%CVE-2026-56764MEDIUMHono - Timing Attack in basicAuth and bearerAuth MiddlewareEPSS 0.3%CVE-2025-46570LOWvLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-ChannelEPSS 0.3%