CWE-203 · Information Disclosure
Observable Discrepancy
689CVEs
1exploited
11with a public check
17likely (EPSS 10%+)
SortMost likely exploited
689 CVEs with CWE-203 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-39891In CISA KEVExploitedIn the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploite…Twilio · Authy · CVSS 5.3 · 2024-07-02 | 5.3 | 1.7% | 2024-07-02 |
| CVE-2004-1602CheckProFTPD 1.2.x - Username Enumeration via Timing AttackProftpd · Proftpd · 2005-02-20 | – | 31% | 2005-02-20 |
| CVE-2021-44848CheckThinfinity VirtualUI User EnumerationCybelesoft · Thinfinity Virtualui · 2021-12-13 | – | 23% | 2021-12-13 |
| CVE-2020-28208CheckRocket.Chat <3.9.1 - Information DisclosureRocket.chat · Rocket.chat · 2021-01-08 | – | 11% | 2021-01-08 |
| CVE-2020-25200CheckPritunl VPN Server 1.29.2145.25 - Username EnumerationPritunl · Pritunl · 2020-10-01 | – | 7.5% | 2020-10-01 |
| CVE-2024-54767CheckAVM FRITZ!Box 7530 AX - Unauthorized AccessNo vendor recorded · CVSS 7.5 · 2025-01-06 | 7.5 | 2.1% | 2025-01-06 |
| CVE-2024-6420CheckHide My WP Ghost < 5.2.02 - Hidden Login Page DisclosureWpplugins · Hide My WP Ghost · CVSS 8.6 · 2024-07-23 | 8.6 | 1.8% | 2024-07-23 |
| CVE-2025-4302CheckStop User Enumeration WordPress plugin - Authentication BypassFullworksplugins · Stop User Enumeration · CVSS 5.3 · 2025-07-17 | 5.3 | 1.0% | 2025-07-17 |
| CVE-2025-59716CheckownCloud Guests - User EnumerationOwncloud · Guests · CVSS 5.3 · 2025-11-05 | 5.3 | 1.0% | 2025-11-05 |
| CVE-2024-6289CheckWPS Hide Login < 1.9.16.4 - Hidden Login Page DisclosureWpserveur · WPS Hide Login · CVSS 6.1 · 2024-07-15 | 6.1 | 0.9% | 2024-07-15 |
| CVE-2023-3139CheckProtect WP Admin < 4.0 - Unauthenticated Protection BypassWp-Experts · Protect WP Admin · 2023-07-04 | – | 0.7% | 2023-07-04 |
| CVE-2026-33425CheckDiscourse - Private Group Membership Inference via exclude_groupsdiscourse · discourse · CVSS 6.9 · 2026-03-20 | 6.9 | 0.7% | 2026-03-20 |
| CVE-2017-5753Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a sid…Intel Corporation · Most Modern Operating Systems · CVSS 5.6 · 2018-01-04 | 5.6 | 94% | 2018-01-04 |
| CVE-2003-0190OpenSSH-portable (OpenSSH) 3.6.1p1 and earlier with PAM support enabled immediately sends an error message when a user does not exist, which allows remote attackers to determine v…Openbsd · Openssh · 2003-05-02 | – | 77% | 2003-05-02 |
| CVE-2017-5715Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access…Intel Corporation · Microprocessors with Speculative Execution · CVSS 5.6 · 2018-01-04 | 5.6 | 73% | 2018-01-04 |
| CVE-2018-3639Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthor…Intel Corporation · Multiple · CVSS 5.5 · 2018-05-22 | 5.5 | 60% | 2018-05-22 |
| CVE-2017-13099wolfSSL Bleichenbacher/ROBOTwolfSSL · wolfSSL · CVSS 7.5 · 2017-12-13 | 7.5 | 27% | 2017-12-13 |
| CVE-2017-13098BouncyCastle JCE TLS Bleichenbacher/ROBOTLegion of the Bouncy Castle · BouncyCastle TLS · CVSS 7.5 · 2017-12-13 | 7.5 | 24% | 2017-12-13 |
| CVE-2022-4304Timing Oracle in RSA DecryptionOpenSSL · OpenSSL · CVSS 5.9 · 2023-02-08 | 5.9 | 24% | 2023-02-08 |
| CVE-2017-1000385The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages wi…Erlang · Erlang/otp · 2017-12-12 | – | 22% | 2017-12-12 |
| CVE-2017-6168On BIG-IP versions 11.6.0-11.6.2 (fixed in 11.6.2 HF1), 12.0.0-12.1.2 HF1 (fixed in 12.1.2 HF2), or 13.0.0-13.0.0 HF2 (fixed in 13.0.0 HF3) a virtual server configured with a Clie…F5 · Big-Ip Ltm · 2017-11-17 | – | 20% | 2017-11-17 |
| CVE-2019-16516An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker t…Connectwise · Control · 2020-01-23 | – | 20% | 2020-01-23 |
| CVE-2022-20866Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software RSA Private Key Leak VulnerabilityCisco · Cisco Adaptive Security Appliance (ASA) Software · CVSS 7.4 · 2022-08-10 | 7.4 | 18% | 2022-08-10 |
| CVE-2019-15590-byte record padding oracleOpenSSL · OpenSSL · 2019-02-27 | – | 17% | 2019-02-27 |
| CVE-2017-17427Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack ("Bleichenbacher attack"). This allows an attacker…Radware · Alteon Firmware · 2017-12-13 | – | 16% | 2017-12-13 |
| CVE-2021-45901The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists.Servicenow · Servicenow · 2022-02-10 | – | 14% | 2022-02-10 |
| CVE-2019-13383In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response.Control-Webpanel · Webpanel · 2019-07-16 | – | 14% | 2019-07-16 |
| CVE-2003-0078ssl3_get_record in s3_pkt.c for OpenSSL before 0.9.7a and 0.9.6 before 0.9.6i does not perform a MAC computation if an incorrect block cipher padding is used, which causes an info…Openssl · Openssl · 2004-09-01 | – | 14% | 2004-09-01 |
| CVE-2022-24436Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via network access.Intel · Intel(R) Processors · CVSS 6.5 · 2022-06-15 | 6.5 | 12% | 2022-06-15 |
| CVE-2017-9735Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before reje…Eclipse · Jetty · 2017-06-16 | – | 9.6% | 2017-06-16 |
| CVE-2019-10071The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could l…Apache · Apache Tapestry · 2019-09-16 | – | 8.8% | 2019-09-16 |
| CVE-2019-10848Computrols CBAS 18.0.0 allows Username Enumeration.Computrols · Computrols Building Automation Software · 2019-05-24 | – | 8.5% | 2019-05-24 |
| CVE-2016-0762The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied pas…Apache Software Foundation · Apache Tomcat · 2017-08-10 | – | 8.0% | 2017-08-10 |
| CVE-2001-1528AmTote International homebet program returns different error messages when invalid account numbers and PIN codes are provided, which allows remote attackers to determine the exist…Amtote · Homebet · 2005-07-14 | – | 7.9% | 2005-07-14 |
| CVE-2019-16394SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers…Spip · Spip · 2019-09-17 | – | 7.3% | 2019-09-17 |
| CVE-2023-20569A side channel vulnerability on some of the AMD CPUs may allow an attacker to influence the return address prediction. This may result in speculative execution at an attacker-cont…AMD · Ryzen™ 3000 Series Desktop Processors · 2023-08-08 | – | 7.3% | 2023-08-08 |
| CVE-2018-3640Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an at…Intel Corporation · Multiple · 2018-05-22 | – | 7.1% | 2018-05-22 |
| CVE-2021-20147ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote…Zohocorp · ManageEngine ADSelfService Plus · 2022-01-03 | – | 7.1% | 2022-01-03 |
| CVE-2018-3615Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 da…Intel Corporation · Multiple · CVSS 7.3 · 2018-08-14 | 7.3 | 6.3% | 2018-08-14 |
| CVE-2021-38153Timing Attack Vulnerability for Apache Kafka Connect and ClientsApache Software Foundation · Apache Kafka · 2021-09-22 | – | 6.2% | 2021-09-22 |
| CVE-2018-3620Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker…Intel Corporation · Multiple · CVSS 5.6 · 2018-08-14 | 5.6 | 5.6% | 2018-08-14 |
| CVE-2016-20012OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion i…Openbsd · Openssh · CVSS 5.3 · 2021-09-15 | 5.3 | 5.3% | 2021-09-15 |
| CVE-2016-6489The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack.Nettle Project · Nettle · 2017-04-14 | – | 5.0% | 2017-04-14 |
| CVE-2020-1968Raccoon attackOpenSSL · OpenSSL · CVSS 3.7 · 2020-09-09 | 3.7 | 4.9% | 2020-09-09 |
| CVE-2022-34125front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file parameter.Glpi-Project · Cmdb · CVSS 6.5 · 2023-04-16 | 6.5 | 4.6% | 2023-04-16 |
| CVE-2021-27342An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote attacker to circumvent the anti-brute-fo…Dlink · Dir-842e Firmware · 2021-05-17 | – | 4.6% | 2021-05-17 |
| CVE-2020-1459Windows ARM Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 7.5 · 2020-08-17 | 7.5 | 4.5% | 2020-08-17 |
| CVE-2004-2252The firewall in Astaro Security Linux before 4.024 sends responses to SYN-FIN packets, which makes it easier for remote attackers to obtain information about the system and constr…Sophos · Astaro Security Linux · 2005-07-17 | – | 4.2% | 2005-07-17 |
| CVE-2019-13599In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.848, the Login process allows attackers to check whether a username is valid by comparing response times.Control-Webpanel · Webpanel · 2019-08-21 | – | 4.0% | 2019-08-21 |
| CVE-2019-1563Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkeyOpenSSL · OpenSSL · 2019-09-10 | – | 3.8% | 2019-09-10 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.