Fallos del tipo CWE-208

193 resultados

Discrepância de Tempo Observável

A fraqueza ocorre quando o tempo de execução de uma operação sensível (como validação de senha, verificação de token ou decisão criptográfica) varia dependendo do resultado, permitindo um atacante inferir informações pela duração da resposta. Diferenças de milissegundos podem revelar se um palpite estava correto.

Ejemplo

Um sistema valida senha comparando string por string: se o primeiro caractere estiver errado, retorna erro imediatamente; se estiver certo, continua comparando o segundo. Um atacante mede o tempo de resposta e deduz o padrão correto caractere por caractere, sem precisar da senha correta.

Cómo mitigar

Use funções de comparação constante (ex: `crypto.timingSafeEqual()` em Node.js ou `hmac_equals()` em PHP) que levam o mesmo tempo independente do ponto de falha. Para operações complexas, adicione delays aleatórios ou processe sempre a operação completa antes de retornar resultado.

CVE-2021-31406MEDIUMTiming side channel vulnerability in endpoint request handler in Vaadin 15-19EPSS 0.2%CVE-2021-31404MEDIUMTiming side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18EPSS 0.2%CVE-2023-25000MEDIUMVault Vulnerable to Cache-Timing Attacks During Seal and Unseal OperationsEPSS 0.2%CVE-2026-45410MEDIUMTime-based user enumeration in TREK authentication endpointEPSS 0.2%CVE-2026-6727MEDIUMCVE-2026-6727EPSS 0.2%CVE-2024-40640LOWUsage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemacEPSS 0.2%CVE-2026-40263LOWNote Mark: Username Enumeration via Login Endpoint Timing Side-ChannelEPSS 0.2%CVE-2026-41418MEDIUM4ga Boards: User Enumeration via Timing Side-Channel in Authentication EndpointEPSS 0.2%CVE-2026-5091MEDIUMCatalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacksEPSS 0.2%CVE-2024-1543MEDIUMAES T-Table sub-cache-line leakageEPSS 0.2%CVE-2026-15432HIGHObservable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerificationEPSS 0.2%CVE-2026-54736HIGHPhalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)EPSS 0.2%CVE-2026-72701MEDIUMGrav CMS before 2.0.16 Timing Attack via verifyNonceEPSS 0.2%CVE-2026-69247HIGHcryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingEPSS 0.2%CVE-2026-70437LOWJenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checkEPSS 0.2%CVE-2025-20067MEDIUMObservable timing discrepancy in firmware for some Intel(R) CSME and Intel(R) SPS may allow a privileged user to potentially enable informatEPSS 0.2%CVE-2025-8774LOWriscv-boom SonicBOOM L1 Data Cache timing discrepancyEPSS 0.2%CVE-2023-20572MEDIUMAn observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message autheEPSS 0.2%CVE-2023-20540LOWAn observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message autheEPSS 0.2%CVE-2020-35165MEDIUMDell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable TimEPSS 0.2%