Falhas do tipo CWE-203

395 resultados

Discrepância Observável em Comportamento

Ocorre quando o sistema exibe comportamentos ou mensagens diferentes dependendo de informações secretas (senha, token, chave), permitindo que um atacante deduza essas informações através de análise de resposta. O perigo está em vazar conhecimento que deveria ser privado por meio de canais laterais, como tempo de resposta, mensagens de erro ou mudanças visuais.

Exemplo

Um formulário de login que retorna 'Usuário não existe' para usuários inválidos e 'Senha incorreta' para usuários válidos com senha errada. Um atacante usa essas mensagens diferentes para enumerar contas válidas sem nunca adivinhar a senha correta.

Como mitigar

Padronize respostas do sistema: retorne sempre a mesma mensagem genérica (ex: 'Credenciais inválidas') e o mesmo tempo de resposta, independentemente de qual parte falhou. Use técnicas como constant-time comparison para operações sensíveis e evite vazar informações através de timing, códigos HTTP diferenciados ou feedback textual discriminador.

CVE-2021-47664MEDIUMEnumeration of valid user namesEPSS 0.4%CVE-2026-67193MEDIUMXlight FTP Server < 3.9.5 Information Disclosure via USER CommandEPSS 0.4%CVE-2025-6386HIGHTiming Attack Vulnerability in parisneo/lollmsEPSS 0.4%CVE-2022-24695MEDIUMBluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in NonEPSS 0.4%CVE-2026-112995HIGHObservable discrepancy in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a EPSS 0.4%CVE-2026-113203HIGHObservable discrepancy in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafteEPSS 0.4%CVE-2026-59341MEDIUMSealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpointsEPSS 0.4%CVE-2020-36888MEDIUMSpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login ScriptEPSS 0.4%CVE-2024-5697MEDIUMA website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox. This vulnerabilEPSS 0.4%CVE-2026-105675HIGHGhost: Invite Token Disclosure in Ghost Admin APIEPSS 0.4%CVE-2026-26185MEDIUMDirectus Affected by User Enumeration via Password Reset Timing AttackEPSS 0.4%CVE-2026-65314MEDIUMElectric Postgres Sync Excluded-Column Value Inference via Subset Where ClausesEPSS 0.4%CVE-2025-57770MEDIUMZITADEL user enumeration vulnerability in login UIEPSS 0.4%CVE-2020-10369MEDIUMCertain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow inferences about memory conteEPSS 0.4%CVE-2020-10367MEDIUMCertain Cypress (and Broadcom) Wireless Combo chips, when a January 2021 firmware update is not present, allow memory access via a "Spectra"EPSS 0.4%CVE-2026-114064MEDIUMSnipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing EndpointEPSS 0.4%CVE-2024-21251LOWVulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.24, 21.3-21.15 and 23.4EPSS 0.4%CVE-2025-6011LOWTiming Side-Channel in Vault’s Userpass Auth MethodEPSS 0.4%CVE-2024-54454MEDIUMAn issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. An Observable REPSS 0.4%CVE-2024-30257LOW1Panel's password verification is suspected to have a timing attack vulnerabilityEPSS 0.4%