Observable Response Discrepancy

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

CVEs (168)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-31248 1Suse 1Manager Server Jun 17, 2026 Jun 22, 2022 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 space...Show more A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37-1.Show less
CVE-2022-0564 1Qlik 1Qlik Sense Jun 17, 2026 Feb 21, 2022 N/A· v4 5.3 MEDIUM· v3 4.3 MEDIUM· v2 A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system....Show more A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured. The affected URI is /internal_forms_authentication/ the response time of the form is longer if the supplied user does not exists and shorter if the user exists.Show less
CVE-2021-20049 1Sonicwall 6Sma 100 Firmware Sma 200 FirmwareSma 210 Firmware+3 more Jun 17, 2026 Dec 23, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37...Show more A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnerability impacts 10.2.1.2-24sv, 10.2.0.8-37sv and earlier 10.x versions.Show less
CVE-2021-34580 1Mbconnectline 2Mbconnect24 Mymbconnect24 Jun 17, 2026 Oct 27, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.
CVE-2021-38476 1Inhandnetworks 1Ir615 Firmware Jun 17, 2026 Oct 19, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 authentication process response indicates and validates the existence of a username. This may allow an attacker to enumerate different user accounts.
CVE-2021-39189 1Pimcore 1Pimcore Jun 17, 2026 Sep 15, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a worka...Show more Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually.Show less
CVE-2020-11063 1Typo3 1Typo3 Jun 17, 2026 May 13, 2020 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on emai...Show more In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to mount user enumeration based on email addresses assigned to backend user accounts. This has been fixed in 10.4.2.Show less
CVE-2016-9499 1Accellion 1Ftp Server Nov 21, 2024 Jul 13, 2018 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is invalid. An attacker may use this information to determine valid user accounts and enumerate them.

Previous 1...5 6 7 89