Falhas do tipo CWE-203

395 resultados

Discrepância Observável em Comportamento

Ocorre quando o sistema exibe comportamentos ou mensagens diferentes dependendo de informações secretas (senha, token, chave), permitindo que um atacante deduza essas informações através de análise de resposta. O perigo está em vazar conhecimento que deveria ser privado por meio de canais laterais, como tempo de resposta, mensagens de erro ou mudanças visuais.

Exemplo

Um formulário de login que retorna 'Usuário não existe' para usuários inválidos e 'Senha incorreta' para usuários válidos com senha errada. Um atacante usa essas mensagens diferentes para enumerar contas válidas sem nunca adivinhar a senha correta.

Como mitigar

Padronize respostas do sistema: retorne sempre a mesma mensagem genérica (ex: 'Credenciais inválidas') e o mesmo tempo de resposta, independentemente de qual parte falhou. Use técnicas como constant-time comparison para operações sensíveis e evite vazar informações através de timing, códigos HTTP diferenciados ou feedback textual discriminador.

CVE-2026-113167HIGHObservable discrepancy in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted EPSS 0.4%CVE-2022-50800MEDIUMH3C SSL VPN n/a Username Enumeration via Login Script Credential VerificationEPSS 0.4%CVE-2026-58445LOWCross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel APIEPSS 0.4%CVE-2021-34576MEDIUMObservable discrepancy in Kaden PICOFLUX AiR leaks water consumptionEPSS 0.4%CVE-2026-103272HIGHGhost 2.10.0 before 6.63.0 Staff Enumeration via Content APIEPSS 0.4%CVE-2026-26895MEDIUMUser enumeration vulnerability in /pwreset.php in osTicket v1.18.2 allows remote attackers to enumerate valid usernames registered in the plEPSS 0.4%CVE-2026-56339HIGHCapgo - Unauthenticated Organization Existence Enumeration via rescind_invitation RPCEPSS 0.4%CVE-2026-37064MEDIUMUser enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the appEPSS 0.4%CVE-2025-52576MEDIUMKanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection BypassEPSS 0.4%CVE-2023-38327MEDIUMAn issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unautEPSS 0.4%CVE-2023-53943MEDIUMGLPI 9.5.7 Username Enumeration Vulnerability via Lost Password EndpointEPSS 0.4%CVE-2023-46739MEDIUMTiming attack can leak user passwordsEPSS 0.4%CVE-2025-64749MEDIUMDirectus Vulnerable to Information Leakage in Existing CollectionsEPSS 0.3%CVE-2024-1544MEDIUMECDSA nonce bias caused by truncationEPSS 0.3%CVE-2026-112992CRITICALObservable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a crafted HEPSS 0.3%CVE-2026-113056CRITICALObservable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak cross-origin data via a EPSS 0.3%CVE-2026-72632HIGHObservable Discrepancy in Kibana Fleet Leading to Disclosure of Elastic Agent Elasticsearch API KeysEPSS 0.3%CVE-2026-59640HIGHOpenPGP CFB quick-check oracle active on symmetric/session-key pathsEPSS 0.3%CVE-2025-40732HIGHUser enumeration vulnerability in Daily Expense ManagerEPSS 0.3%CVE-2026-73630MEDIUMSiYuan before v3.7.4 Information Disclosure via authFilePublishAccessEPSS 0.3%