# CWE-208.

Every Advisory and CVE whose sources give the weakness CWE-208, newest first.

## Records, newest first (an older page)

- [Apache Doris: Timing Attack weakness](https://agentprime.io/advisories/CVE-2023-41313.md)
  `CVE-2023-41313` · CVE record: Apache Software Foundation Apache Doris · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Mar 2024 · Tags: CWE-208
- [m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657](https://agentprime.io/advisories/GHSA-944j-8ch6-rf6x.md)
  `GHSA-944j-8ch6-rf6x`, `CVE-2023-50781`, `PYSEC-2026-1595` · PyPI `m2crypto`: affected `<=0.40.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 5 Feb 2024 · Tags: Information disclosure, CWE-208, CWE-385
- [Python Cryptography package vulnerable to Bleichenbacher timing oracle attack](https://agentprime.io/advisories/GHSA-3ww4-gg4f-jr7f.md)
  `GHSA-3ww4-gg4f-jr7f`, `CVE-2023-50782`, `PYSEC-2026-1283` · PyPI `cryptography`: affected `<42.0.0`, fixed in `42.0.0` · CVSS 7.5 High · Not analysed yet · Published 5 Feb 2024 · Tags: Information disclosure, CWE-208, CWE-385
- [Cryptlib: rsa key exchange ciphersuites in tls vulnerable to marvin attack](https://agentprime.io/advisories/CVE-2024-0202.md)
  `CVE-2024-0202` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 5 Feb 2024 · Tags: CWE-208
- [Dell BSAFE Micro Edition Suite: Dell BSAFE Micro Edition Suite, versions before 4.5.2…](https://agentprime.io/advisories/CVE-2021-21575.md)
  `CVE-2021-21575` · CVE record: Dell BSAFE Micro Edition Suite · CVSS 5.9 Medium · Not analysed yet · Published 2 Feb 2024 · Tags: CWE-208
- [vantage6 vulnerable to username timing attack](https://agentprime.io/advisories/GHSA-45gq-q4xh-cp53.md)
  `GHSA-45gq-q4xh-cp53`, `CVE-2024-21671`, `PYSEC-2024-31`, `PYSEC-2026-2008` · PyPI `vantage6-server`: affected `<4.2.0`, fixed in `4.2.0` · CVSS 3.7 Low · Not analysed yet · Published 30 Jan 2024 · Tags: CWE-208
- [Minerva timing attack on P-256 in python-ecdsa](https://agentprime.io/advisories/GHSA-wj6h-64fc-37mp.md)
  `GHSA-wj6h-64fc-37mp`, `CVE-2024-23342`, `PYSEC-2026-1325` · PyPI `ecdsa`: affected `*`, no fixed version yet · CVSS 7.4 High · Not analysed yet · Published 22 Jan 2024 · Tags: Information disclosure, CWE-208, CWE-385
- [Potential Timing vulnerability in CBC PKCS7 padding calculations](https://agentprime.io/advisories/CVE-2023-41097.md)
  `CVE-2023-41097` · CVE record: silabs.com GSDK · CVSS 4.6 Medium · Not analysed yet · Published 21 Dec 2023 · Tags: Weak cryptography or TLS, CWE-208
- [Gnutls: timing side-channel in the rsa-psk authentication](https://agentprime.io/advisories/CVE-2023-5981.md)
  `CVE-2023-5981` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 28 Nov 2023 · Tags: CWE-208
- [generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character](https://agentprime.io/advisories/GHSA-4gpm-r23h-gprw.md)
  `GHSA-4gpm-r23h-gprw`, `CVE-2015-20110` · npm `generator-jhipster`: affected `<2.23.0`, fixed in `2.23.0` · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2023 · Tags: Authentication bypass, CWE-208
- [Jenkins Gogs Plugin uses non-constant time webhook token comparison](https://agentprime.io/advisories/GHSA-885r-hhpr-cc9p.md)
  `GHSA-885r-hhpr-cc9p`, `CVE-2023-46657` · Maven `org.jenkins-ci.plugins:gogs-webhook`: affected `<=1.0.15`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-208, CWE-697
- [Jenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison](https://agentprime.io/advisories/GHSA-8859-v9jp-cphf.md)
  `GHSA-8859-v9jp-cphf`, `CVE-2023-46656` · Maven `igalg.jenkins.plugins:multibranch-scan-webhook-trigger`: affected `<=1.0.9`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-208, CWE-697
- [Non-constant time webhook token hash comparison in Jenkins Zanata Plugin](https://agentprime.io/advisories/GHSA-86j9-25m2-9w97.md)
  `GHSA-86j9-25m2-9w97`, `CVE-2023-46660` · Maven `org.jenkins-ci.plugins:zanata`: affected `<=0.6`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-208, CWE-697
- [Jenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison](https://agentprime.io/advisories/GHSA-2xpq-5952-38w3.md)
  `GHSA-2xpq-5952-38w3`, `CVE-2023-46658` · Maven `io.jenkins.plugins:teams-webhook-trigger`: affected `<=0.1.1`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-208, CWE-697
- [SK_LOAD timing side channel during AES module decryption in Texas Instruments OMAP L138](https://agentprime.io/advisories/CVE-2022-25332.md)
  `CVE-2022-25332` · CVE record: Texas Instruments OMAP · CVSS 4.4 Medium · Not analysed yet · Published 19 Oct 2023 · Tags: CWE-208
- [Harbor timing attack risk](https://agentprime.io/advisories/GHSA-mq6f-5xh5-hgcf.md)
  `GHSA-mq6f-5xh5-hgcf`, `BIT-harbor-2023-20902`, `CVE-2023-20902`, `GO-2023-2109` · Go `github.com/goharbor/harbor`: affected `<1.10.18 || >=2.0.0, <2.7.3 || >=2.8.0, <2.8.3`, fixed in `1.10.18`, `2.7.3`, `2.8.3` · CVSS 5.9 Medium · Not analysed yet · Published 10 Oct 2023 · Tags: Race condition, CWE-208
- [NVIDIA DGX H100 BMC: NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon…](https://agentprime.io/advisories/CVE-2023-25529.md)
  `CVE-2023-25529` · CVE record: NVIDIA DGX H100 BMC and 1 more · CVSS 8.0 High · Not analysed yet · Published 20 Sept 2023 · Tags: CWE-208
- [silverware-io-issue-tracker server responds in a noticeably different amount of time depending if a given email address exists or not](https://agentprime.io/advisories/CVE-2023-40182.md)
  `CVE-2023-40182` · CVE record: mesosoi silverwaregames-io-issue-tracker · CVSS 3.7 Low · Not analysed yet · Published 25 Aug 2023 · Tags: CWE-208
- [Timing Attack Reveals CSRF Tokens in oppia](https://agentprime.io/advisories/CVE-2023-40021.md)
  `CVE-2023-40021` · CVE record: oppia oppia · CVSS 5.3 Medium · Not analysed yet · Published 16 Aug 2023 · Tags: Information disclosure, CWE-208
- [Non-constant time HMAC comparison in Adyen plugin in Saleor](https://agentprime.io/advisories/CVE-2023-32694.md)
  `CVE-2023-32694` · CVE record: saleor saleor · CVSS 4.8 Medium · Not analysed yet · Published 25 May 2023 · Tags: Information disclosure, CWE-208
- [An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbit...](https://agentprime.io/advisories/GHSA-2jg5-xgvv-4wq7.md)
  `GHSA-2jg5-xgvv-4wq7`, `CVE-2021-34337`, `PYSEC-2023-22` · PyPI `mailman`: affected `<3.3.5`, fixed in `3.3.5` · CVSS 6.3 Medium · Not analysed yet · Published 15 Apr 2023 · Tags: CWE-208
- [HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks](https://agentprime.io/advisories/GHSA-vq4h-9ghm-qmrr.md)
  `GHSA-vq4h-9ghm-qmrr`, `BIT-vault-2023-25000`, `CVE-2023-25000`, `GO-2023-1709` · Go `github.com/hashicorp/vault`: affected `<1.11.9 || >=1.12.0, <1.12.5 || >=1.13.0, <1.13.1`, fixed in `1.11.9`, `1.12.5`, `1.13.1` · CVSS 5.0 Medium · Not analysed yet · Published 30 Mar 2023 · Tags: Information disclosure, CWE-208
- [OpenSearch has time discrepancy in authentication responses](https://agentprime.io/advisories/GHSA-c6wg-cm5x-rqvj.md)
  `GHSA-c6wg-cm5x-rqvj`, `CVE-2023-25806` · Maven `org.opensearch.plugin:opensearch-security`: affected `<1.3.9 || >=2.0.0, <2.6.0`, fixed in `1.3.9`, `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 7 Mar 2023 · Tags: Information disclosure, CWE-208
- [Observable timing discrepancy in JOpenId](https://agentprime.io/advisories/GHSA-m4f8-p58g-j8mj.md)
  `GHSA-m4f8-p58g-j8mj`, `CVE-2010-10006` · Maven `org.expressme:JOpenId`: affected `<1.08`, fixed in `1.08` · CVSS 2.6 Low · Not analysed yet · Published 18 Jan 2023 · Tags: Information disclosure, CWE-208
- [Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator](https://agentprime.io/advisories/GHSA-jmj6-p2j9-68cp.md)
  `GHSA-jmj6-p2j9-68cp`, `CVE-2022-3143` · Maven `org.wildfly.security:wildfly-elytron`: affected `<1.15.15.Final || >=1.16.0.CR1, <1.20.3.Final`, fixed in `1.15.15.Final`, `1.20.3.Final` · CVSS 7.4 High · Not analysed yet · Published 13 Jan 2023 · Tags: Information disclosure, CWE-208
- [NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may lead to an information disclosure.](https://agentprime.io/advisories/CVE-2022-42288.md)
  `CVE-2022-42288` · CVE record: NVIDIA NVIDIA DGX servers · CVSS 5.3 Medium · Not analysed yet · Published 13 Jan 2023 · Tags: CWE-208
- [Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy](https://agentprime.io/advisories/GHSA-vg5x-6q66-rvgx.md)
  `GHSA-vg5x-6q66-rvgx`, `CVE-2016-15015`, `PKSA-ns9c-fdtm-d37z` · Packagist `barzahlen/barzahlen-php`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 2.6 Low · Not analysed yet · Published 8 Jan 2023 · Tags: Information disclosure, CWE-208
- [Pylons horus services.py timing discrepancy](https://agentprime.io/advisories/CVE-2014-125056.md)
  `CVE-2014-125056` · CVE record: Pylons horus · CVSS 2.6 Low · Not analysed yet · Published 7 Jan 2023 · Tags: CWE-208
- [Timing attack in github.com/openshift/osin](https://agentprime.io/advisories/GHSA-m7qp-cj9p-gj85.md)
  `GHSA-m7qp-cj9p-gj85`, `CVE-2021-4294`, `GO-2022-1201` · Go `github.com/openshift/osin`: affected `<1.0.2-0.20210113124101-8612686d6dda`, fixed in `1.0.2-0.20210113124101-8612686d6dda` · CVSS 2.6 Low · Not analysed yet · Published 3 Jan 2023 · Tags: CWE-208
- [Ziftr primecoin bitcoinrpc.cpp HTTPAuthorized timing discrepancy](https://agentprime.io/advisories/CVE-2013-10006.md)
  `CVE-2013-10006` · CVE record: Ziftr primecoin · CVSS 2.6 Low · Not analysed yet · Published 1 Jan 2023 · Tags: CWE-208
- [InSTEDD Nuntium geopoll_controller.rb timing discrepancy](https://agentprime.io/advisories/CVE-2022-4823.md)
  `CVE-2022-4823` · CVE record: InSTEDD Nuntium · CVSS 3.1 Low · Not analysed yet · Published 28 Dec 2022 · Tags: CWE-208
- [Non-constant time webhook token comparison in Jenkins GitLab Plugin](https://agentprime.io/advisories/GHSA-f9f9-4r63-4qcc.md)
  `GHSA-f9f9-4r63-4qcc`, `CVE-2022-43411` · Maven `org.jenkins-ci.plugins:gitlab-plugin`: affected `<1.5.36`, fixed in `1.5.36` · CVSS 3.7 Low · Not analysed yet · Published 19 Oct 2022 · Tags: Information disclosure, CWE-208
- [Non-constant time webhook token comparison in Jenkins Generic Webhook Trigger Plugin](https://agentprime.io/advisories/GHSA-2jxx-2x93-2q2f.md)
  `GHSA-2jxx-2x93-2q2f`, `CVE-2022-43412` · Maven `org.jenkins-ci.plugins:generic-webhook-trigger`: affected `<1.84.2`, fixed in `1.84.2` · CVSS 3.7 Low · Not analysed yet · Published 19 Oct 2022 · Tags: Information disclosure, CWE-208
- [GoCD API authentication of user access tokens subject to timing attack during comparison](https://agentprime.io/advisories/CVE-2022-39308.md)
  `CVE-2022-39308` · CVE record: gocd gocd · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2022 · Tags: CWE-208, CWE-1254
- [Atlantis Events vulnerable to Timing Attack](https://agentprime.io/advisories/GHSA-jxqv-jcvh-7gr4.md)
  `GHSA-jxqv-jcvh-7gr4`, `CVE-2022-24912`, `GO-2022-0534` · Go `github.com/runatlantis/atlantis`: affected `<0.19.7`, fixed in `0.19.7` · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2022 · Tags: Information disclosure, CWE-208
- [Jenkins GitHub plugin uses weak webhook signature function](https://agentprime.io/advisories/GHSA-mxcc-7h5m-x57r.md)
  `GHSA-mxcc-7h5m-x57r`, `CVE-2022-36885` · Maven `com.coravy.hudson.plugins.github:github`: affected `<1.34.5`, fixed in `1.34.5` · CVSS 3.1 Low · Not analysed yet · Published 28 Jul 2022 · Tags: Information disclosure, CWE-208
- [fastify-bearer-auth vulnerable to Timing Attack Vector](https://agentprime.io/advisories/GHSA-376v-xgjx-7mfr.md)
  `GHSA-376v-xgjx-7mfr`, `CVE-2022-31142` · npm `@fastify/bearer-auth` and 1 more: affected `<7.0.2 || >=8.0.0, <8.0.1`, fixed in `7.0.2`, `8.0.1` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2022 · Tags: Information disclosure, CWE-208
- [Cisco Unified Communications Products Timing Attack Vulnerability](https://agentprime.io/advisories/CVE-2022-20752.md)
  `CVE-2022-20752` · CVE record: Cisco Cisco Unified Communications Manager · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2022 · Tags: CWE-208
- [Observable timing discrepancy allows determining username validity in Jenkins](https://agentprime.io/advisories/GHSA-9grj-j43m-mjqr.md)
  `GHSA-9grj-j43m-mjqr`, `BIT-jenkins-2022-34174`, `CVE-2022-34174` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.334, <2.356 || <2.332.4`, fixed in `2.356`, `2.332.4` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jun 2022 · Tags: Information disclosure, CWE-208
- [Login timing attack in ibexa/core](https://agentprime.io/advisories/GHSA-2x4v-g8cx-jxrq.md)
  `GHSA-2x4v-g8cx-jxrq`, `PKSA-33kf-45bv-4rz6` · Packagist `ibexa/core`: affected `>=4.0.0, <4.0.7 || >=4.1.0, <4.1.4`, fixed in `4.0.7`, `4.1.4` · No CVSS score · Not analysed yet · Published 2 Jun 2022 · Tags: CWE-208
- [Login timing attack in ezsystems/ezpublish-kernel](https://agentprime.io/advisories/GHSA-xfqg-p48g-hh94.md)
  `GHSA-xfqg-p48g-hh94`, `PKSA-ns35-p1q3-5g4c` · Packagist `ezsystems/ezpublish-kernel`: affected `>=7.5.0, <7.5.29`, fixed in `7.5.29` · No CVSS score · Not analysed yet · Published 2 Jun 2022 · Tags: CWE-208
- [Login timing attack in ezsystems/ezplatform-kernel](https://agentprime.io/advisories/GHSA-342c-vcff-2ff2.md)
  `GHSA-342c-vcff-2ff2`, `PKSA-ssmb-br6s-zrg7` · Packagist `ezsystems/ezplatform-kernel`: affected `>=1.3.0, <1.3.19`, fixed in `1.3.19` · No CVSS score · Not analysed yet · Published 2 Jun 2022 · Tags: CWE-208
- [Non-constant time comparison of inbound TCP agent connection secret](https://agentprime.io/advisories/GHSA-w7jr-wqw6-54xc.md)
  `GHSA-w7jr-wqw6-54xc`, `BIT-jenkins-2020-2101`, `CVE-2020-2101` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.204.2 || >=2.205, <2.219`, fixed in `2.204.2`, `2.219` · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2022 · Tags: Information disclosure, CWE-208
- [Non-constant time HMAC comparison](https://agentprime.io/advisories/GHSA-fj6f-6933-839j.md)
  `GHSA-fj6f-6933-839j`, `BIT-jenkins-2020-2102`, `CVE-2020-2102` · Maven `org.jenkins-ci.main:jenkins-core`: affected `<2.204.2 || >=2.205, <2.219`, fixed in `2.204.2`, `2.219` · CVSS 5.3 Medium · Not analysed yet · Published 24 May 2022 · Tags: Information disclosure, CWE-208
- [Symfony Vulnerable to Timing Attack](https://agentprime.io/advisories/GHSA-g97c-jfx6-xvxh.md)
  `GHSA-g97c-jfx6-xvxh`, `CVE-2015-8125`, `PKSA-5979-1yv4-cw4f`, `PKSA-krbp-gnkk-54bj`, `PKSA-vjxr-btnx-3nkm`, `PKSA-x6by-dh6n-pzrc` · Packagist `symfony/form` and 3 more: affected `>=2.3.0, <2.3.35 || >=2.4.0, <2.6.12 || >=2.7.0, <2.7.7`, fixed in `2.3.35`, `2.6.12`, `2.7.7` · No CVSS score · Not analysed yet · Published 17 May 2022 · Tags: CWE-208
- [Timing attack](https://agentprime.io/advisories/GHSA-8vxv-2g8p-2249.md)
  `GHSA-8vxv-2g8p-2249`, `CVE-2022-29185`, `RUSTSEC-2022-0018` · crates.io `totp-rs`: affected `>=0.0.0-0, <1.1.0`, fixed in `1.1.0` · CVSS 4.2 Medium · Not analysed yet · Published 9 May 2022 · Tags: Information disclosure, CWE-208
- [Siemens RUGGEDCOM i800: A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802…](https://agentprime.io/advisories/CVE-2021-42016.md)
  `CVE-2021-42016` · CVE record: Siemens RUGGEDCOM i800 and 4 more · CVSS 7.5 High · Not analysed yet · Published 8 Mar 2022 · Tags: CWE-208
- [Apache Hive Information Exposure and Observable Timing Discrepancy](https://agentprime.io/advisories/GHSA-54g4-5cf6-hjp3.md)
  `GHSA-54g4-5cf6-hjp3`, `CVE-2020-1926` · Maven `org.apache.hive:hive`: affected `<2.3.8`, fixed in `2.3.8` · CVSS 5.9 Medium · Not analysed yet · Published 9 Feb 2022 · Tags: Information disclosure, CWE-208
- [The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting.](https://agentprime.io/advisories/CVE-2021-43298.md)
  `CVE-2021-43298` · CVE record: embedthis goahead · No CVSS score · Not analysed yet · Published 25 Jan 2022 · Tags: CWE-208
- [Observable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin](https://agentprime.io/advisories/GHSA-fpj7-9xm6-8hgr.md)
  `GHSA-fpj7-9xm6-8hgr`, `CVE-2022-23106` · Maven `io.jenkins:configuration-as-code`: affected `>=1.55, <1.55.1 || >=1.54, <1.54.1 || >=1.48, <1.53.1 || <1.47.1`, fixed in `1.55.1`, `1.54.1`, `1.53.1`, `1.47.1` · CVSS 3.7 Low · Not analysed yet · Published 21 Jan 2022 · Tags: Information disclosure, CWE-208
- [Side-channels Related to the x86 PREFETCH Instruction](https://agentprime.io/advisories/CVE-2021-26318.md)
  `CVE-2021-26318` · CVE record: AMD All supported processors · No CVSS score · Not analysed yet · Published 13 Oct 2021 · Tags: CWE-208
- [libsecp256k1 contains side-channel timing attack](https://agentprime.io/advisories/GHSA-hrjm-c879-pp86.md)
  `GHSA-hrjm-c879-pp86`, `CVE-2019-25003`, `RUSTSEC-2019-0027` · crates.io `libsecp256k1`: affected `<0.3.1`, fixed in `0.3.1` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2021 · Tags: CWE-208
- [Observable Timing Discrepancy in aaugustin websockets library](https://agentprime.io/advisories/GHSA-8ch4-58qp-g3mp.md)
  `GHSA-8ch4-58qp-g3mp`, `CVE-2021-33880`, `PYSEC-2021-95` · PyPI `websockets`: affected `<9.1`, fixed in `9.1` · CVSS 5.9 Medium · Not analysed yet · Published 11 Jun 2021 · Tags: Information disclosure, CWE-208
- [AMD Speculative execution with Floating-Point Value Injection](https://agentprime.io/advisories/CVE-2021-26314.md)
  `CVE-2021-26314` · CVE record: AMD All supported processors · No CVSS score · Not analysed yet · Published 9 Jun 2021 · Tags: CWE-208
- [AMD Speculative Code Store Bypass](https://agentprime.io/advisories/CVE-2021-26313.md)
  `CVE-2021-26313` · CVE record: AMD All supported processors · No CVSS score · Not analysed yet · Published 9 Jun 2021 · Tags: CWE-208
- [Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime](https://agentprime.io/advisories/GHSA-rvcw-f68w-8h8h.md)
  `GHSA-rvcw-f68w-8h8h`, `CVE-2021-29446` · npm `jose-node-cjs-runtime`: affected `<3.11.4`, fixed in `3.11.4` · CVSS 5.9 Medium · Not analysed yet · Published 19 Apr 2021 · Tags: Information disclosure, CWE-208, CWE-696
- [Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime](https://agentprime.io/advisories/GHSA-4v4g-726h-xvfv.md)
  `GHSA-4v4g-726h-xvfv`, `CVE-2021-29445` · npm `jose-node-esm-runtime`: affected `<3.11.4`, fixed in `3.11.4` · CVSS 5.9 Medium · Not analysed yet · Published 19 Apr 2021 · Tags: Information disclosure, CWE-208, CWE-696
- [Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18](https://agentprime.io/advisories/GHSA-xwg3-qrcg-w9x6.md)
  `GHSA-xwg3-qrcg-w9x6`, `CVE-2021-31404` · Maven `com.vaadin:flow-server`: affected `>=1.0.0, <1.0.14 || >=1.1.0, <2.4.7 || >=3.0.0, <5.0.3`, fixed in `1.0.14`, `2.4.7`, `5.0.3` · CVSS 4.0 Medium · Not analysed yet · Published 19 Apr 2021 · Tags: Information disclosure, CWE-208
- [Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8](https://agentprime.io/advisories/GHSA-75xc-qvxh-27f8.md)
  `GHSA-75xc-qvxh-27f8`, `CVE-2021-31403` · Maven `com.vaadin:vaadin-bom` and 1 more: affected `>=7.0.0, <7.7.24 || >=8.0.0, <8.12.3`, fixed in `7.7.24`, `8.12.3` · CVSS 4.0 Medium · Not analysed yet · Published 19 Apr 2021 · Tags: Information disclosure, CWE-208
- [Timing side channel vulnerability in endpoint request handler in Vaadin 15-19](https://agentprime.io/advisories/GHSA-p7jq-v8jp-j424.md)
  `GHSA-p7jq-v8jp-j424`, `CVE-2021-31406` · Maven `com.vaadin:flow-server`: affected `>=3.0.0, <5.0.4 || >=6.0.0, <6.0.1`, fixed in `5.0.4`, `6.0.1` · CVSS 4.0 Medium · Not analysed yet · Published 19 Apr 2021 · Tags: Information disclosure, CWE-208

Newest: <https://agentprime.io/advisories/tag/cwe-208.md>
Older: <https://agentprime.io/advisories/tag/cwe-208.md?cursor=WyIyMDIxLTA0LTE5VDE0OjUwOjM4LjAwMDAwMFoiLCJHSFNBLXA3anEtdjhqcC1qNDI0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-208&cursor=WyIyMDI0LTAzLTE1VDE2OjQ0OjM2LjAwMDAwMFoiLCJHSFNBLTVoM3gtNmd3Zi03M2ptIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-208/?cursor=WyIyMDI0LTAzLTE1VDE2OjQ0OjM2LjAwMDAwMFoiLCJHSFNBLTVoM3gtNmd3Zi03M2ptIl0>. Everything for agents: <https://agentprime.io/llms.txt>.