Falhas do tipo CWE-203

398 resultados

Discrepância Observável em Comportamento

Ocorre quando o sistema exibe comportamentos ou mensagens diferentes dependendo de informações secretas (senha, token, chave), permitindo que um atacante deduza essas informações através de análise de resposta. O perigo está em vazar conhecimento que deveria ser privado por meio de canais laterais, como tempo de resposta, mensagens de erro ou mudanças visuais.

Exemplo

Um formulário de login que retorna 'Usuário não existe' para usuários inválidos e 'Senha incorreta' para usuários válidos com senha errada. Um atacante usa essas mensagens diferentes para enumerar contas válidas sem nunca adivinhar a senha correta.

Como mitigar

Padronize respostas do sistema: retorne sempre a mesma mensagem genérica (ex: 'Credenciais inválidas') e o mesmo tempo de resposta, independentemente de qual parte falhou. Use técnicas como constant-time comparison para operações sensíveis e evite vazar informações através de timing, códigos HTTP diferenciados ou feedback textual discriminador.

CVE-2026-79287MEDIUMObservable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafEPSS 0.3%CVE-2026-79028MEDIUMObservable discrepancy in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crEPSS 0.3%CVE-2026-87518MEDIUMObservable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the rEPSS 0.3%CVE-2025-43739MEDIUMLiferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.EPSS 0.3%CVE-2026-3579LOWNon-constant time multiplication subroutine __muldi3 on RISC-V RV32IEPSS 0.3%CVE-2022-48220MEDIUMPotential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusioEPSS 0.3%CVE-2025-24391MEDIUMPossible user enumerationEPSS 0.3%CVE-2025-11932LOWTiming Side-Channel in PSK Binder VerificationEPSS 0.3%CVE-2025-39665MEDIUMLivestatus Injection in dynmapsEPSS 0.3%CVE-2025-54477MEDIUMJoomla! Core - [20250902] User-Enumeration in passkey authentication methodEPSS 0.3%CVE-2024-54476MEDIUMThe issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app mEPSS 0.3%CVE-2025-13166LOWUsername Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account DiscoveryEPSS 0.3%CVE-2026-121130MEDIUMObservable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafEPSS 0.3%CVE-2025-13736LOWUsername Enumeration via Login Interface in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.3%CVE-2026-14112MEDIUMInappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage EPSS 0.3%CVE-2024-41760LOWIBM Common Cryptographic Architecture information disclosureEPSS 0.3%CVE-2026-79016MEDIUMObservable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTEPSS 0.3%CVE-2026-87619MEDIUMObservable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a craftedEPSS 0.3%CVE-2026-87516MEDIUMObservable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a craftEPSS 0.3%CVE-2026-105652LOWGhost: Password Hash Ordering Disclosure in Ghost Admin APIEPSS 0.3%