Common Weakness Enumeration
CWE-203
AllowedObservable Discrepancy
Abstraction: Base · Status: Incomplete
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
886 vulnerabilities reference this CWE, most recent first.
GHSA-8XX5-H6M3-JR33
Vulnerability from github – Published: 2025-09-04 20:01 – Updated: 2025-09-10 21:02
VLAI
Summary
Presta Shop vulnerable to email enumeration
Details
Impact
An unauthenticated attacker with access to the back-office URL can manipulate the id_employee and reset_token parameters to enumerate valid back-office employee email addresses.
Impacted parties: Store administrators and employees: their email addresses are exposed. Merchants: risk of phishing, social engineering, and brute-force attacks targeting admin accounts.
Patches
PrestaShop 8.2.3
Workarounds
You must upgrade, or at least apply the changes from the PrestaShop 8.2.3 patch. More information: https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release/
Severity
4.2 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "prestashop/prestashop"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-51586"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-359"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-04T20:01:00Z",
"nvd_published_at": "2025-09-08T17:15:33Z",
"severity": "MODERATE"
},
"details": "### Impact\nAn unauthenticated attacker with access to the back-office URL can manipulate the id_employee and reset_token parameters to enumerate valid back-office employee email addresses.\n\nImpacted parties:\nStore administrators and employees: their email addresses are exposed.\nMerchants: risk of phishing, social engineering, and brute-force attacks targeting admin accounts.\n\n### Patches\nPrestaShop 8.2.3\n\n### Workarounds\nYou must upgrade, or at least apply the changes from the PrestaShop 8.2.3 patch. More information: https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release/",
"id": "GHSA-8xx5-h6m3-jr33",
"modified": "2025-09-10T21:02:35Z",
"published": "2025-09-04T20:01:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-8xx5-h6m3-jr33"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-51586"
},
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/commit/c97bdf10f77fedbe5a61a1dec5f96b3abb1d76fb"
},
{
"type": "WEB",
"url": "https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release"
},
{
"type": "PACKAGE",
"url": "https://github.com/PrestaShop/PrestaShop"
},
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.1"
},
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.3"
},
{
"type": "WEB",
"url": "https://maxime-morel.github.io/advisories/2025/CVE-2025-51586.md"
},
{
"type": "WEB",
"url": "https://prestashop.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Presta Shop vulnerable to email enumeration "
}
GHSA-92CV-8JC7-JRPM
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-06-04 00:00
VLAI
Details
Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-26314"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-09T12:15:00Z",
"severity": "MODERATE"
},
"details": "Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.",
"id": "GHSA-92cv-8jc7-jrpm",
"modified": "2022-06-04T00:00:52Z",
"published": "2022-05-24T19:04:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26314"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SVA2NY26MMXOODUMYZN5DCU3FXMBMBOB"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/06/09/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/06/10/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-92G2-RGHG-V947
Vulnerability from github – Published: 2026-07-21 21:32 – Updated: 2026-07-21 21:32
VLAI
Details
djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application's responses.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-64822"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-21T21:16:53Z",
"severity": "MODERATE"
},
"details": "djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error messages returned by the password reset endpoint. Attackers can submit arbitrary usernames or email addresses to the POST login/esqueceu/ endpoint and distinguish between existing and non-existing accounts based on observable discrepancies in the application\u0027s responses.",
"id": "GHSA-92g2-rghg-v947",
"modified": "2026-07-21T21:32:43Z",
"published": "2026-07-21T21:32:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64822"
},
{
"type": "WEB",
"url": "https://github.com/thiagopena/djangoSIGE/pull/163"
},
{
"type": "WEB",
"url": "https://github.com/americooo/pentest-writeups/tree/main/djangoSIGE-CVE-2026-64821-64822"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/djangosige-user-enumeration-via-forgotpasswordview"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-92VW-GR5G-P72G
Vulnerability from github – Published: 2024-12-26 12:30 – Updated: 2024-12-26 12:30
VLAI
Details
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-47155"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-26T12:15:07Z",
"severity": "MODERATE"
},
"details": "Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.",
"id": "GHSA-92vw-gr5g-p72g",
"modified": "2024-12-26T12:30:45Z",
"published": "2024-12-26T12:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47155"
},
{
"type": "WEB",
"url": "https://www.honor.com/global/security/cve-2024-47155"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-93CV-HRV4-P8Q4
Vulnerability from github – Published: 2024-06-15 15:30 – Updated: 2024-06-15 15:30
VLAI
Details
IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having authority to the related *USRPRF objects. This can be used by a malicious actor to gather information about users that can be targeted in further attacks. IBM X-Force ID: 287174.
Severity
{
"affected": [],
"aliases": [
"CVE-2024-31870"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-204"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-15T14:15:09Z",
"severity": "LOW"
},
"details": "IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having authority to the related *USRPRF objects. This can be used by a malicious actor to gather information about users that can be targeted in further attacks. IBM X-Force ID: 287174.",
"id": "GHSA-93cv-hrv4-p8q4",
"modified": "2024-06-15T15:30:27Z",
"published": "2024-06-15T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31870"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/287174"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7157638"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-944J-8CH6-RF6X
Vulnerability from github – Published: 2024-02-05 21:30 – Updated: 2026-02-27 20:57
VLAI
Summary
m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657
Details
A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "m2crypto"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.40.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-50781"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208",
"CWE-385"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-05T22:41:57Z",
"nvd_published_at": "2024-02-05T21:15:10Z",
"severity": "MODERATE"
},
"details": "A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.",
"id": "GHSA-944j-8ch6-rf6x",
"modified": "2026-02-27T20:57:08Z",
"published": "2024-02-05T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50781"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-50781"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254426"
},
{
"type": "PACKAGE",
"url": "https://gitlab.com/m2crypto/m2crypto"
},
{
"type": "WEB",
"url": "https://gitlab.com/m2crypto/m2crypto/-/issues/342"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657"
}
GHSA-94GG-72CX-MG6F
Vulnerability from github – Published: 2024-11-01 18:31 – Updated: 2024-11-05 00:31
VLAI
Details
An issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Password function.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-40490"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-01T16:15:08Z",
"severity": "HIGH"
},
"details": "An issue in Sourcebans++ before v.1.8.0 allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Password function.",
"id": "GHSA-94gg-72cx-mg6f",
"modified": "2024-11-05T00:31:27Z",
"published": "2024-11-01T18:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40490"
},
{
"type": "WEB",
"url": "https://github.com/sbpp/sourcebans-pp/issues/975"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-94HH-PJJG-RWMR
Vulnerability from github – Published: 2021-04-19 14:58 – Updated: 2023-03-17 17:49
VLAI
Summary
Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime
Details
Impact
AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed JWEDecryptionFailed would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).
Patches
A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are >=3.11.4.
Users should upgrade to ^3.11.4.
Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "jose-browser-runtime"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.11.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-29444"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-16T23:00:49Z",
"nvd_published_at": "2021-04-16T22:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\n[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).\n\n### Patches\n\nA patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `\u003e=3.11.4`.\n\nUsers should upgrade to `^3.11.4`.\n\n### Credits\nThanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.",
"id": "GHSA-94hh-pjjg-rwmr",
"modified": "2023-03-17T17:49:50Z",
"published": "2021-04-19T14:58:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/panva/jose/security/advisories/GHSA-94hh-pjjg-rwmr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29444"
},
{
"type": "PACKAGE",
"url": "https://github.com/panva/jose"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/jose-browser-runtime"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime"
}
GHSA-94RR-MJ9R-877F
Vulnerability from github – Published: 2023-05-31 00:31 – Updated: 2024-04-04 04:24
VLAI
Details
Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-33741"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-30T22:15:10Z",
"severity": "HIGH"
},
"details": "Macrovideo v380pro v1.4.97 shares the device id and password when sharing the device.",
"id": "GHSA-94rr-mj9r-877f",
"modified": "2024-04-04T04:24:08Z",
"published": "2023-05-31T00:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33741"
},
{
"type": "WEB",
"url": "https://github.com/zzh-newlearner/record/blob/main/macrovideo_share.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-957C-5X9M-M7RV
Vulnerability from github – Published: 2022-05-13 01:41 – Updated: 2025-04-20 03:49
VLAI
Details
The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).
Severity
5.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-1000385"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-12T21:29:00Z",
"severity": "MODERATE"
},
"details": "The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server\u0027s private key (this is a variation of the Bleichenbacher attack).",
"id": "GHSA-957c-5x9m-m7rv",
"modified": "2025-04-20T03:49:49Z",
"published": "2022-05-13T01:41:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000385"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0242"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0303"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0368"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:0528"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00010.html"
},
{
"type": "WEB",
"url": "https://robotattack.org"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3571-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2017/dsa-4057"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/144389"
},
{
"type": "WEB",
"url": "http://erlang.org/pipermail/erlang-questions/2017-November/094255.html"
},
{
"type": "WEB",
"url": "http://erlang.org/pipermail/erlang-questions/2017-November/094256.html"
},
{
"type": "WEB",
"url": "http://erlang.org/pipermail/erlang-questions/2017-November/094257.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102197"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-46
Architecture and Design
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-39
Implementation
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
CAPEC-189: Black Box Reverse Engineering
An adversary discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs. Black Box Reverse Engineering also refers to gathering physical side effects of a hardware device, such as electromagnetic radiation or sounds.