522
Reference Description
CVE-2004-1428 FTP server generates an error message if the user name does not exist
instead of prompting for a password, which allows remote attackers to
determine valid usernames.
https://www.cve.org/CVERecord?id=CVE-2004-1428
CVE-2003-0078 SSL implementation does not perform a MAC computation if an incorrect
block cipher padding is used, which causes an information leak (timing
discrepancy) that may make it easier to launch cryptographic attacks that
rely on distinguishing between padding and MAC verification errors, possibly
leading to extraction of the original plaintext, aka the "Vaudenay timing attack."
https://www.cve.org/CVERecord?id=CVE-2003-0078
CVE-2000-1117 Virtual machine allows malicious web site operators to determine the
existence of files on the client by measuring delays in the execution of the
getSystemResource method.
https://www.cve.org/CVERecord?id=CVE-2000-1117
CVE-2003-0637 Product uses a shorter timeout for a non-existent user than a valid user, which
makes it easier for remote attackers to guess usernames and conduct brute
force password guessing.
https://www.cve.org/CVERecord?id=CVE-2003-0637
CVE-2003-0190 Product immediately sends an error message when a user does not exist,
which allows remote attackers to determine valid usernames via a timing
attack.
https://www.cve.org/CVERecord?id=CVE-2003-0190
CVE-2004-1602 FTP server responds in a different amount of time when a given username
exists, which allows remote attackers to identify valid usernames by timing the
server response.
https://www.cve.org/CVERecord?id=CVE-2004-1602
CVE-2005-0918 Browser allows remote attackers to determine the existence of arbitrary files
by setting the src property to the target filename and using Javascript to
determine if the web page immediately stops loading, which indicates whether
the file exists or not.
https://www.cve.org/CVERecord?id=CVE-2005-0918
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 717 OWASP Top Ten 2007 Category A6 - Information
Leakage and Improper Error Handling
629 2332
MemberOf 728 OWASP Top Ten 2004 Category A7 - Improper Error
Handling
711 2337
MemberOf 884 CWE Cross-section 884 2567
MemberOf 967 SFP Secondary Cluster: State Disclosure 888 2403
MemberOf 1205 Security Primitives and Cryptography Issues 1194 2473
MemberOf 1417 Comprehensive Categorization: Sensitive Information
Exposure
1400 2548
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Discrepancy Information Leaks
OWASP Top Ten 2007 A6 CWE More Specific Information Leakage and Improper
Error Handling
OWASP Top Ten 2004 A7 CWE More Specific Improper Error Handling
CWE Version 4.14
CWE-204: Observable Response Discrepancy
CWE-204: Observable Response Discrepancy