532
Reference Description
CVE-2019-10482 Smartphone OS uses comparison functions that are not in constant time,
allowing side channels
https://www.cve.org/CVERecord?id=CVE-2019-10482
CVE-2014-0984 Password-checking function in router terminates validation of a password entry
when it encounters the first incorrect character, which allows remote attackers
to obtain passwords via a brute-force attack that relies on timing differences in
responses to incorrect password guesses, aka a timing side-channel attack.
https://www.cve.org/CVERecord?id=CVE-2014-0984
CVE-2003-0078 SSL implementation does not perform a MAC computation if an incorrect
block cipher padding is used, which causes an information leak (timing
discrepancy) that may make it easier to launch cryptographic attacks that
rely on distinguishing between padding and MAC verification errors, possibly
leading to extraction of the original plaintext, aka the "Vaudenay timing attack."
https://www.cve.org/CVERecord?id=CVE-2003-0078
CVE-2000-1117 Virtual machine allows malicious web site operators to determine the
existence of files on the client by measuring delays in the execution of the
getSystemResource method.
https://www.cve.org/CVERecord?id=CVE-2000-1117
CVE-2003-0637 Product uses a shorter timeout for a non-existent user than a valid user, which
makes it easier for remote attackers to guess usernames and conduct brute
force password guessing.
https://www.cve.org/CVERecord?id=CVE-2003-0637
CVE-2003-0190 Product immediately sends an error message when a user does not exist,
which allows remote attackers to determine valid usernames via a timing
attack.
https://www.cve.org/CVERecord?id=CVE-2003-0190
CVE-2004-1602 FTP server responds in a different amount of time when a given username
exists, which allows remote attackers to identify valid usernames by timing the
server response.
https://www.cve.org/CVERecord?id=CVE-2004-1602
CVE-2005-0918 Browser allows remote attackers to determine the existence of arbitrary files
by setting the src property to the target filename and using Javascript to
determine if the web page immediately stops loading, which indicates whether
the file exists or not.
https://www.cve.org/CVERecord?id=CVE-2005-0918
Functional Areas
• Cryptography
• Authentication
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 967 SFP Secondary Cluster: State Disclosure 888 2403
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Notes
Relationship
Often primary in cryptographic applications and algorithms.
Taxonomy Mappings
CWE Version 4.14
CWE-209: Generation of Error Message Containing Sensitive Information
CWE-209: Generation of Error Message Containing Sensitive Information