Falhas do tipo CWE-203

398 resultados

Discrepância Observável em Comportamento

Ocorre quando o sistema exibe comportamentos ou mensagens diferentes dependendo de informações secretas (senha, token, chave), permitindo que um atacante deduza essas informações através de análise de resposta. O perigo está em vazar conhecimento que deveria ser privado por meio de canais laterais, como tempo de resposta, mensagens de erro ou mudanças visuais.

Exemplo

Um formulário de login que retorna 'Usuário não existe' para usuários inválidos e 'Senha incorreta' para usuários válidos com senha errada. Um atacante usa essas mensagens diferentes para enumerar contas válidas sem nunca adivinhar a senha correta.

Como mitigar

Padronize respostas do sistema: retorne sempre a mesma mensagem genérica (ex: 'Credenciais inválidas') e o mesmo tempo de resposta, independentemente de qual parte falhou. Use técnicas como constant-time comparison para operações sensíveis e evite vazar informações através de timing, códigos HTTP diferenciados ou feedback textual discriminador.

CVE-2026-118312CRITICALObservable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data viEPSS 0.2%CVE-2026-87539LOWObservable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafteEPSS 0.2%CVE-2026-111933MEDIUMCoder before 2.34.2 User Enumeration via Login Placeholder HashEPSS 0.2%CVE-2025-46804LOWScreen 5.0.0 and older versions allow file existence tests when installed setuid-rootEPSS 0.2%CVE-2026-106180LOWObservable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin datEPSS 0.2%CVE-2026-47011LOWVulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface). Supported versions that are affEPSS 0.2%CVE-2026-118338HIGHObservable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafEPSS 0.2%CVE-2026-88834LOWBusybox: busybox: httpd user existence oracle in non-default shadow-disabled buildsEPSS 0.2%CVE-2026-106506MEDIUMBackstage: Improper input validation in scaffolder task list orderingEPSS 0.2%CVE-2026-23620MEDIUMGFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File EnumerationEPSS 0.2%CVE-2025-54999LOWOpenBao: Timing Side-Channel in Userpass Auth MethodEPSS 0.2%CVE-2026-106210LOWObservable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a craftedEPSS 0.2%CVE-2026-106351MEDIUMObservable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the rEPSS 0.2%CVE-2024-23984MEDIUMObservable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosuEPSS 0.2%CVE-2026-106303MEDIUMObservable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proEPSS 0.2%CVE-2018-9364HIGHIn the LG LAF component, there is a special command that allowed modification of certain partitions. This could lead to bypass of secure booEPSS 0.2%CVE-2026-45294MEDIUMFreeScout: User Account Enumeration via Password Reset Response DifferentiationEPSS 0.2%CVE-2026-103275MEDIUMGhost 5.42.2 before 6.58.0 Password Hash DisclosureEPSS 0.2%CVE-2024-27839MEDIUMA privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 17.5 and iPadOS 17.5. A malicioEPSS 0.2%CVE-2026-104415LOWGhost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin APIEPSS 0.2%