Skip to content
Noroxi

CWE-203 · 683 records

Observable Discrepancy

CVEs in this class

684 records

  • CVE-2024-39891
    52Plan

    In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to

    MediumCVSS 5.3KEVWeaponizedEPSS 1%

    twilio · authyJul 2, 2024

  • CVE-2017-5753
    50Plan

    Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an at

    MediumCVSS 5.6Proof of conceptEPSS 93%

    intel · atom cJan 4, 2018

  • CVE-2017-5715
    44Plan

    Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information

    MediumCVSS 5.6Proof of conceptEPSS 74%

    intel · atom cJan 4, 2018

  • CVE-2003-0190
    43Plan

    OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which

    MediumCVSS 5.0WeaponizedEPSS 76%

    openbsd · opensshMay 12, 2003

  • CVE-2019-10071
    42Plan

    The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparis

    CriticalCVSS 9.8No exploitEPSS 8%

    apache · tapestrySep 16, 2019

  • CVE-2018-3639
    40Plan

    Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior mem

    MediumCVSS 5.5Proof of conceptEPSS 60%

    intel · atom cMay 22, 2018

  • CVE-2022-23303
    40Plan

    The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    w1.fi · hostapdJan 16, 2022

  • CVE-2022-23304
    40Plan

    The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of c

    CriticalCVSS 9.8No exploitEPSS 1%

    w1.fi · hostapdJan 16, 2022

  • CVE-2018-1000884
    39Monitor

    Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information

    CriticalCVSS 9.8No exploitEPSS 1%

    vestacp · vesta control panelDec 20, 2018

  • CVE-2024-23771
    39Monitor

    darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypas

    CriticalCVSS 9.8No exploitEPSS 1%

    unix4lyfe · darkhttpdJan 22, 2024

  • CVE-2024-25189
    39Monitor

    libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing

    CriticalCVSS 9.8No exploitEPSS 0%

    libjwt · libjwtFeb 8, 2024

  • CVE-2024-25190
    39Monitor

    l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing

    CriticalCVSS 9.8No exploitEPSS 0%

    glitchedpolygons · l8w8jwtFeb 8, 2024

  • CVE-2023-40756
    39Monitor

    User enumeration is found in PHPJabbers Callback Widget v1.0.

    CriticalCVSS 9.8No exploitEPSS 0%

    phpjabbers · callback widgetAug 28, 2023

  • CVE-2024-25191
    39Monitor

    php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing

    CriticalCVSS 9.8No exploitEPSS 0%

    zihanggao · php-jwtFeb 8, 2024

  • CVE-2024-25714
    39Monitor

    In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops

    CriticalCVSS 9.8No exploitEPSS 0%

    rhonabwy project · rhonabwyFeb 10, 2024

  • CVE-2023-50708
    39Monitor

    yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

    CriticalCVSS 9.8No exploitEPSS 0%

    yiiframework · yii2-authclientDec 22, 2023

  • CVE-2025-27667
    39Monitor

    Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumerati

    CriticalCVSS 9.8No exploitEPSS 0%

    printerlogic · vasion printMar 5, 2025

  • CVE-2022-40895
    37Monitor

    In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to a

    CriticalCVSS 9.1No exploitEPSS 2%

    nedi · nediOct 6, 2022

  • CVE-2026-72699
    37Monitor

    Grav Login Plugin before 3.9.1 Email Enumeration via Registration

    CriticalCVSS 9.3No exploitEPSS 0%

    getgrav · grav-plugin-loginAug 25, 2026

  • CVE-2023-26556
    36Monitor

    io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication impleme

    CriticalCVSS 9.1No exploitEPSS 0%

    iofinnet · tss-libApr 21, 2023

  • CVE-2026-74961
    36Monitor

    Side-channel in the Web Audio component

    CriticalCVSS 9.1No exploitEPSS 0%

    mozilla · firefoxAug 18, 2026

  • GHSA-346h-749j-r28w
    36Monitor

    PHPECC vulnerable to multiple cryptographic side-channel attacks

    CriticalCVSS 9.1No exploit

    Packagist · mdanter/eccApr 25, 2024

  • CVE-2017-6168
    35Monitor

    On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3)

    HighCVSS 7.4WeaponizedEPSS 19%

    f5 · big-ip ltmNov 17, 2017

  • CVE-2022-20866
    35Monitor

    Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software RSA Private Key Leak Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 17%

    cisco · adaptive security appliance softwareAug 10, 2022

  • CVE-2024-6420
    35Monitor

    Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure

    HighCVSS 8.6Proof of conceptEPSS 1%

    wpplugins · hide my wp ghostJul 23, 2024

All vulnerability classes