Fallos del tipo CWE-208

192 resultados

Discrepância de Tempo Observável

A fraqueza ocorre quando o tempo de execução de uma operação sensível (como validação de senha, verificação de token ou decisão criptográfica) varia dependendo do resultado, permitindo um atacante inferir informações pela duração da resposta. Diferenças de milissegundos podem revelar se um palpite estava correto.

Ejemplo

Um sistema valida senha comparando string por string: se o primeiro caractere estiver errado, retorna erro imediatamente; se estiver certo, continua comparando o segundo. Um atacante mede o tempo de resposta e deduz o padrão correto caractere por caractere, sem precisar da senha correta.

Cómo mitigar

Use funções de comparação constante (ex: `crypto.timingSafeEqual()` em Node.js ou `hmac_equals()` em PHP) que levam o mesmo tempo independente do ponto de falha. Para operações complexas, adicione delays aleatórios ou processe sempre a operação completa antes de retornar resultado.

CVE-2026-58272MEDIUMSync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)EPSS 0.3%CVE-2026-28475MEDIUMOpenClaw < 2026.2.13 - Timing Attack via Hook Token ComparisonEPSS 0.3%CVE-2026-55785LOWfree5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKAEPSS 0.3%CVE-2025-59058MEDIUMhttpsig-rs's HMAC verification is vulnerable to timing attackEPSS 0.3%CVE-2024-41828LOWIn JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant timeEPSS 0.3%CVE-2026-25597MEDIUMPrestaShop has a time based enumeration in FO login formEPSS 0.3%CVE-2026-16731HIGHAuthentication and authorization bypass via cryptographic timing side-channel attack in StationScoutEPSS 0.3%CVE-2025-54499LOWInsecure string comparison enables timing attacksEPSS 0.3%CVE-2025-59438MEDIUMMbed TLS through 3.6.4 has an Observable Timing Discrepancy.EPSS 0.3%CVE-2026-40972HIGHAn attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote seEPSS 0.3%CVE-2026-78500MEDIUMDimension Blind SSRF via Database Test Connection FeatureEPSS 0.3%CVE-2026-16315HIGHAuthentication and authorization bypass via cryptographic timing side-channel attack in StationGuardEPSS 0.3%CVE-2026-59276MEDIUMTiming Attack via Non-Constant-Time Comparison of Sensitive ValuesEPSS 0.3%CVE-2026-81159LOWCommerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106EPSS 0.3%CVE-2026-72700HIGHGrav before 3.9.1 Timing Attack via Non-Constant-Time Token ComparisonEPSS 0.3%CVE-2026-53525HIGHWeeChat has Non-Constant-Time Password Hash Comparison in Relay AuthenticationEPSS 0.3%CVE-2025-43754MEDIUMUsername enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 throughEPSS 0.3%CVE-2020-11037MEDIUMPotential Observable Timing Discrepancy in WagtailEPSS 0.3%CVE-2026-80199MEDIUMKimai before 2.54.0 Username Enumeration via Timing OracleEPSS 0.2%CVE-2026-18259HIGHToken Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090EPSS 0.2%