CWE-203— Observable Discrepancy (Information Exposure via Side Channel)

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.— MITRE CWE catalog

869 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-203page 9 of 18

CVE-2021-1013MEDIUMCVSS 5.5EG 5.5
2021-12-15
In checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission of PermissionManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th…
CVE-2021-1012MEDIUMCVSS 5.5EG 5.5
2021-12-15
In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no…
CVE-2021-1009MEDIUMCVSS 5.5EG 5.5
2021-12-15
In setApplicationCategoryHint of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disc…
CVE-2021-1005MEDIUMCVSS 5.5EG 5.5
2021-12-15
In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosu…
CVE-2021-34556MEDIUMCVSS 5.5EG 5.5
2021-08-02
In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitializ…
CVE-2021-35477MEDIUMCVSS 5.5EG 5.5
2021-08-02
In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur …
CVE-2021-26314MEDIUMCVSS 5.5EG 5.5
2021-06-09
Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and…
CVE-2021-26313MEDIUMCVSS 5.5EG 5.5
2021-06-09
Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwritten instructions, may cause an incorrect speculation and could result in data …
CVE-2021-29415MEDIUMCVSS 5.5EG 5.5
2021-05-21
The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor nRF52840 through 2021-03-29 has a non-constant time ECDSA implemenation. This allows an adversar…
CVE-2021-0321MEDIUMCVSS 5.5EG 5.5
2021-01-11
In enforceDumpPermissionForPackage of ActivityManagerService.java, there is a possible way to determine if a package is installed due to side channel information disclosure. This could lead to local information disclosure with no additiona…
CVE-2020-27026MEDIUMCVSS 5.5EG 5.5
2020-12-15
During boot, the device unlock interface behaves differently depending on if a fingerprint registered to the device is present. This could lead to local information disclosure with no additional execution privileges needed. User interactio…
CVE-2020-0464MEDIUMCVSS 5.5EG 5.5
2020-12-14
In resolv_cache_lookup of res_cache.cpp, there is a possible side channel information disclosure. This could lead to local information disclosure of accessed web resources with no additional execution privileges needed. User interaction is…
CVE-2020-12912MEDIUMCVSS 5.5EG 5.5
2020-11-12
A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has…
CVE-2020-8695MEDIUMCVSS 5.5EG 5.5
2020-11-12
Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
CVE-2020-16150MEDIUMCVSS 5.5EG 5.5
2020-09-02
A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23.0 allows an attacker to recover secret key information. This affects CBC mode because of a computed time difference ba…
CVE-2019-19338MEDIUMCVSS 5.5EG 5.5
2020-07-13
A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is runni…
CVE-2020-13844MEDIUMCVSS 5.5EG 5.5
2020-06-08
Arm Armv8-A core implementations utilizing speculative execution past unconditional changes in control flow may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka "straight-l…
CVE-2019-14067MEDIUMCVSS 5.5EG 5.5
2020-06-02
Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channel issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…
CVE-2019-14007MEDIUMCVSS 5.5EG 5.5
2020-04-16
Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a potential side channel for SUI corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Co…
CVE-2019-10483MEDIUMCVSS 5.5EG 5.5
2020-04-16
Side channel issue in QTEE due to usage of non-time-constant comparison function such as memcmp or strcmp in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IO…
CVE-2019-9472MEDIUMCVSS 5.5EG 5.5
2020-01-06
In DCRYPTO_equals of compare.c, there is a possible timing attack due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitatio…
CVE-2016-2178MEDIUMCVSS 5.5EG 5.5
2016-06-20
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel atta…
CVE-2022-34704MEDIUMCVSS 4.7EG 5.5
2022-08-09
Windows Defender Credential Guard Information Disclosure Vulnerability
CVE-2020-10932MEDIUMCVSS 4.7EG 5.5
2020-04-15
An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by (1) reconstructing the projective coordinate of…
CVE-2024-27839MEDIUMCVSS 3.3EG 5.5
2024-05-14
A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 17.5 and iPadOS 17.5. A malicious application may be able to determine a user's current location.
CVE-2026-121130MEDIUMEG 5.4
2026-11-03
Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121138MEDIUMEG 5.4
2026-11-03
Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVE-2025-13591MEDIUMCVSS 5.3EG 5.3
2026-10-19
The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does not exist in the system, allowing attackers to differentiate between valid and invalid usernames. This difference in res…
CVE-2026-106506MEDIUMCVSS 5.3EG 5.3
2026-10-06
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with…
CVE-2026-106351MEDIUMCVSS 5.3EG 5.3
2026-10-06
Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severit…
CVE-2026-106303MEDIUMCVSS 5.3EG 5.3
2026-10-06
Observable discrepancy in Autofill AI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chr…
CVE-2026-11795MEDIUMCVSS 5.3EG 5.3
2026-10-02
Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: before 5.03.01.54.
CVE-2026-91725MEDIUMCVSS 5.3EG 5.3
2026-09-15
Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-91714MEDIUMCVSS 5.3EG 5.3
2026-09-15
Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2025-5802MEDIUMCVSS 5.3EG 5.3
2026-09-15
The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message …
CVE-2026-87566MEDIUMCVSS 5.3EG 5.3
2026-09-09
Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-87518MEDIUMCVSS 5.3EG 5.3
2026-09-09
Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. (Chromium secu…
CVE-2026-11754MEDIUMCVSS 5.3EG 5.3
2026-08-27
Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported.
CVE-2026-37064MEDIUMCVSS 5.3EG 5.3
2026-08-27
User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen …
CVE-2026-79181MEDIUMCVSS 5.3EG 5.3
2026-08-25
Observable discrepancy in Glic in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-79242MEDIUMCVSS 5.3EG 5.3
2026-08-25
Observable discrepancy in HTML in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-79287MEDIUMCVSS 5.3EG 5.3
2026-08-25
Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-79028MEDIUMCVSS 5.3EG 5.3
2026-08-25
Observable discrepancy in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-79030MEDIUMCVSS 5.3EG 5.3
2026-08-25
Observable discrepancy in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-72699MEDIUMCVSS 5.3EG 5.3
2026-08-25
The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already …
CVE-2026-59502MEDIUMCVSS 5.3EG 5.3
2026-08-13
: Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall…
CVE-2026-59640MEDIUMCVSS 5.3EG 5.3
2026-08-03
In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.1…
CVE-2026-67193MEDIUMCVSS 5.3EG 5.3
2026-07-29
Xlight FTP Server before 3.9.5 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the server's current GetTickCount() value by sending a USER command with a username ending in the :adm suffix. …
CVE-2026-64822MEDIUMCVSS 5.3EG 5.3
2026-07-21
djangoSIGE through 1.10 (commit a6fe7e8) contains a user enumeration vulnerability in ForgotPasswordView within djangosige/apps/login/views.py that allows unauthenticated attackers to identify valid accounts by observing distinct error mes…
CVE-2026-56296MEDIUMCVSS 5.3EG 5.3
2026-07-11
Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existing versus non-existing app IDs. Unauthenticated attackers can enumerate valid ap…

Map vulnerabilities like CWE-203 to your infrastructure

EchelonGraph correlates every CVE — across CWE-203 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →