CVE-2023-1538

CVE-2023-1538 is reported for the GitHub project answerdev/answer with an observable timing discrepancy prior to version 1.0.6. Multiple connected sources (NVD, GHSA, OSV, CNVD, CNVD) describe a user-enumeration-style issue originating in the login process, where valid vs invalid user checks diff...

PT-2023-17061 · Answer +3 · Answer +2

Name of the Vulnerable Software and Affected Versions: answer versions prior to 1.0.6 Description: The issue concerns an Observable Response Discrepancy. No further details are provided about the nature of this discrepancy or its potential impact. There is no information available regarding the...

CVE-2023-1540 Observable Response Discrepancy in answerdev/answer

Observable Response Discrepancy in GitHub repository answerdev/answer prior to 1.0.6...

Observable Response Discrepancy

vantage6server is vulnerable to Observable Response Discrepancy. The vulnerability exists because the login requirement is not properly implemented which allows an attacker to brute force password and observe a valid username response...

CVE-2022-39228 Observable Response Discrepancy in vantage6

vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernames. However, if a wrong password is...

GHSA-36GX-9Q6H-G429 vantage6 vulnerable to Observable Response Discrepancy

Impact We are incorporating the password policies listed in https://github.com/vantage6/vantage6/issues/59. One measure is that we don't let the user know in case of wrong username/password combination if the username actually exists, to prevent that bots can guess usernames. However, if a wrong...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.52 security update

Red Hat OpenShift Container Platform release 4.10.52 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whi...

Siemens Desigo PXC and DXR Devices Observable Discrepancy (CVE-2022-24043)

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The login functionality of the application fails to normalize the response times o...

CVE-2023-0440

Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6...

CVE-2023-0440 Observable Discrepancy in healthchecks/healthchecks

Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6...

CVE-2023-0440

The CVE-2023-0440 entry concerns healthchecks/healthchecks before version 2.6. The issue is described as an observable discrepancy that can expose sensitive information to unauthorized actors. Affected software is Healthchecks (healthchecks/healthchecks); versions prior to 2.6 are vulnerable. Mit...

Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy

A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function verify of the file src/Webhook.php. The manipulation leads to observable timing discrepancy. Upgrading to version 2.0.1 is able to address this issu...

GHSA-VG5X-6Q66-RVGX Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy

A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function verify of the file src/Webhook.php. The manipulation leads to observable timing discrepancy. Upgrading to version 2.0.1 is able to address this issu...

CVE-2016-15015

A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function verify of the file src/Webhook.php. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The...

CVE-2014-125056

A vulnerability was found in Pylons horus and classified as problematic. Affected by this issue is some unknown functionality of the file horus/flows/local/services.py. The manipulation leads to observable timing discrepancy. The complexity of an attack is rather high. The exploitation is known t...

GHSA-R894-5R7V-7RX3 easy-scrypt Observable Timing Discrepancy vulnerability

A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function VerifyPassphrase of the file scrypt.go. The manipulation leads to observable timing discrepancy. Upgrading to version 1.0.0 can address this issue. The name of the patch is...

CVE-2022-4823

A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopollcontroller.rb. The manipulation of the argument signature leads to observable timing discrepancy. It is possible to launch the attack remotely. Th...

OpenShift OSIN vulnerable to Observable Timing Discrepancy

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. I...

CVE-2021-4277

A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshotsync of the component Filename Handler. The manipulation leads to predictable from observable state. The name of the patch is...

utils 安全特征问题漏洞

utils is a utility program by Fred Smith Personal Developer. A security vulnerability exists in utils that stems from a problem with the unknown handling of the screenshotsync file of the Filename Handler component, which can lead to predictions from observable state...