Fallos del tipo CWE-208

193 resultados

Discrepância de Tempo Observável

A fraqueza ocorre quando o tempo de execução de uma operação sensível (como validação de senha, verificação de token ou decisão criptográfica) varia dependendo do resultado, permitindo um atacante inferir informações pela duração da resposta. Diferenças de milissegundos podem revelar se um palpite estava correto.

Ejemplo

Um sistema valida senha comparando string por string: se o primeiro caractere estiver errado, retorna erro imediatamente; se estiver certo, continua comparando o segundo. Um atacante mede o tempo de resposta e deduz o padrão correto caractere por caractere, sem precisar da senha correta.

Cómo mitigar

Use funções de comparação constante (ex: `crypto.timingSafeEqual()` em Node.js ou `hmac_equals()` em PHP) que levam o mesmo tempo independente do ponto de falha. Para operações complexas, adicione delays aleatórios ou processe sempre a operação completa antes de retornar resultado.

CVE-2025-43754MEDIUMUsername enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 throughEPSS 0.3%CVE-2020-11037MEDIUMPotential Observable Timing Discrepancy in WagtailEPSS 0.3%CVE-2026-80199MEDIUMKimai before 2.54.0 Username Enumeration via Timing OracleEPSS 0.2%CVE-2026-18259HIGHToken Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090EPSS 0.2%CVE-2026-82449MEDIUMCockpit CMS before 2.14.1 Account Enumeration via Auth TimingEPSS 0.2%CVE-2026-6291MEDIUMBleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryptionEPSS 0.2%CVE-2026-21840LOWHCL BigFix Platform is affected by a user enumeration vulnerabilityEPSS 0.2%CVE-2025-9031MEDIUMTiming-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive WebEPSS 0.2%CVE-2026-39321MEDIUMParse Server has a login timing side-channel reveals user existenceEPSS 0.2%CVE-2025-29780MEDIUMPost-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix OperationsEPSS 0.2%CVE-2025-48995MEDIUMSignXML's signature verification with HMAC is vulnerable to a timing attackEPSS 0.2%CVE-2026-27882MEDIUMCoolify: Timing Attack in GitLab Webhook Token ValidationEPSS 0.2%CVE-2026-41407MEDIUMOpenClaw < 2026.4.2 - Timing Side Channel in Shared-Secret ComparisonEPSS 0.2%CVE-2026-23901LOWApache Shiro: Brute force attack possible to determine valid user namesEPSS 0.2%CVE-2026-48011LOWShopware: Timing-attack on admin panel allowing enumeration of administrator usernamesEPSS 0.2%CVE-2026-42602HIGHazureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replayEPSS 0.2%CVE-2025-54764MEDIUMMbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcEPSS 0.2%CVE-2026-22746LOWUser Attribute Enumeration when Using DaoAuthenticationProviderEPSS 0.2%CVE-2026-84308MEDIUMphpseclib — non-constant-time X25519 scalar multiplication permits full private-key recoveryEPSS 0.2%CVE-2026-87737MEDIUMAn issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalaEPSS 0.2%