CWE-204 Observable Response Discrepancy
baseThe product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (246)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-7790US | critical9.8OT erhöht | — | ||
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allow… | ||||
| CVE-2019-19030US | medium5.3 | Exploit | ||
Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether… | ||||
| CVE-2022-23342US | medium5.3 | Exploit | ||
The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumeration vulnerability. An… | ||||
| CVE-2015-7902US | medium5.0 | Exploit | ||
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows r… | ||||
| CVE-2002-0212US | high7.5OT erhöht | — | ||
The login for Hosting Controller 1.1 through 1.4.1 returns different error messages when a valid or invalid user is provided, which allows remote attackers to determine the existen… | ||||
| CVE-2026-14177US | high7.5 | — | ||
Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting.
This issue affects ikas E-Commerce Infrastructure… | ||||
| CVE-2026-19205US | high7.5 | — | ||
Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting.
This issue affects GastroMenum Web Panel: before 31.08.2026. | ||||
| CVE-2026-19080US | high7.5 | — | ||
Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting.
This issue affects Menulux Portal: before 20260903211448. | ||||
| CVE-2026-60007US | high7.4 | — | ||
In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowi… | ||||
| CVE-2026-33419US | high7.5 | — | ||
MinIO is a high-performance object storage system. Prior to RELEASE.2026-03-17T21-25-16Z, MinIO AIStor's STS (Security Token Service) AssumeRoleWithLDAPIdentity endpoint is vulnera… | ||||
| CVE-2025-12455US | high7.5 | — | ||
Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing.
The vulnerability could lead to Password Brute Forcing in Vertica management con… | ||||
| CVE-2025-23193US | high7.5 | — | ||
SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, po… | ||||
| CVE-2024-42343US | high7.5 | — | ||
Loway - CWE-204: Observable Response Discrepancy | ||||
| CVE-2024-38431US | high7.5 | — | ||
Matrix Tafnit v8
-
CWE-204: Observable Response Discrepancy | ||||
| CVE-2024-38322US | high7.5 | — | ||
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 2… | ||||
| CVE-2024-28232US | high7.5 | — | ||
Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the lo… | ||||
| CVE-2024-24766US | high7.5 | — | ||
CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumera… | ||||
| CVE-2021-20049US | high7.5 | — | ||
A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerab… | ||||
| CVE-2021-34580US | high7.5 | — | ||
In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attemp… | ||||
| CVE-2022-41697US | medium5.3 | — | ||
A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure of sensitive informati… | ||||
03
Angriffsmuster (4)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan