# CWE-208.

Every Advisory and CVE whose sources give the weakness CWE-208, newest first.

## Records, newest first (an older page)

- [Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18](https://agentprime.io/advisories/GHSA-c6c4-7x48-4cqp.md)
  `GHSA-c6c4-7x48-4cqp` · Maven `com.vaadin:vaadin-bom`: affected `>=10.0.0, <10.0.17 || >=11.0.0, <14.4.7 || >=15.0.0, <18.0.6`, fixed in `10.0.17`, `14.4.7`, `18.0.6` · CVSS 4.0 Medium · Not analysed yet · Published 19 Apr 2021 · Tags: CWE-208
- [Timing side channel vulnerability in endpoint request handler in Vaadin 15-19](https://agentprime.io/advisories/GHSA-9h6g-6mxg-vvp4.md)
  `GHSA-9h6g-6mxg-vvp4` · Maven `com.vaadin:vaadin-bom`: affected `>=19.0.0, <19.0.1 || >=15.0.0, <18.0.7`, fixed in `19.0.1`, `18.0.7` · CVSS 4.0 Medium · Not analysed yet · Published 19 Apr 2021 · Tags: CWE-208
- [Activerecord-session_store Vulnerable to Timing Attack](https://agentprime.io/advisories/GHSA-cvw2-xj8r-mjf7.md)
  `GHSA-cvw2-xj8r-mjf7`, `CVE-2019-25025` · RubyGems `activerecord-session_store`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Mar 2021 · Tags: CWE-208
- [Possible timing attack in derivation_endpoint](https://agentprime.io/advisories/GHSA-5jjv-x4fq-qjwp.md)
  `GHSA-5jjv-x4fq-qjwp`, `CVE-2020-15237` · RubyGems `shrine`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 5.9 Medium · Not analysed yet · Published 5 Oct 2020 · Tags: Information disclosure, CWE-208
- [Timing attack on django-basic-auth-ip-whitelist](https://agentprime.io/advisories/GHSA-m38j-pmg3-v5x5.md)
  `GHSA-m38j-pmg3-v5x5`, `CVE-2020-4071`, `PYSEC-2020-37` · PyPI `django-basic-auth-ip-whitelist`: affected `<0.3.4`, fixed in `0.3.4` · CVSS 2.2 Low · Not analysed yet · Published 23 Jun 2020 · Tags: CWE-208
- [Potential Observable Timing Discrepancy in Wagtail](https://agentprime.io/advisories/GHSA-jjjr-3jcw-f8v6.md)
  `GHSA-jjjr-3jcw-f8v6`, `CVE-2020-11037`, `PYSEC-2020-153` · PyPI `wagtail`: affected `<2.7.3 || >=2.8rc1, <2.8.2 || >=2.9rc1, <2.9`, fixed in `2.7.3`, `2.8.2`, `2.9` · CVSS 6.1 Medium · Not analysed yet · Published 7 May 2020 · Tags: Race condition, CWE-208
- [Possible Information Leak / Session Hijack Vulnerability in Rack](https://agentprime.io/advisories/GHSA-hrqr-hxpp-chr3.md)
  `GHSA-hrqr-hxpp-chr3`, `CVE-2019-16782` · RubyGems `rack`: affected `<1.6.12 || >=2.0.0, <2.0.8`, fixed in `1.6.12`, `2.0.8` · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2019 · Tags: Information disclosure, CWE-208
- [floragunn Search Guard: Search Guard versions before 21.0 had an timing side channel issue when using the…](https://agentprime.io/advisories/CVE-2019-13420.md)
  `CVE-2019-13420` · CVE record: floragunn Search Guard · No CVSS score · Not analysed yet · Published 13 Aug 2019 · Tags: CWE-208
- [express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison](https://agentprime.io/advisories/GHSA-c35v-qwqg-87jc.md)
  `GHSA-c35v-qwqg-87jc` · npm `express-basic-auth`: affected `<1.1.7`, fixed in `1.1.7` · CVSS 3.1 Low · Not analysed yet · Published 6 Jun 2019 · Tags: CWE-208
- [The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side-channel attacks](https://agentprime.io/advisories/CVE-2019-9494.md)
  `CVE-2019-9494` · CVE record: Wi-Fi Alliance hostapd with SAE support and 1 more · No CVSS score · Not analysed yet · Published 17 Apr 2019 · Tags: CWE-208, CWE-524
- [Timing Attack in csrf-lite](https://agentprime.io/advisories/GHSA-hjhr-r3gq-qvp6.md)
  `GHSA-hjhr-r3gq-qvp6`, `CVE-2016-10535` · npm `csrf-lite`: affected `<0.1.2`, fixed in `0.1.2` · No CVSS score · Not analysed yet · Published 18 Feb 2019 · Tags: CWE-208

Newest: <https://agentprime.io/advisories/tag/cwe-208.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-208&cursor=WyIyMDIxLTA0LTE5VDE0OjUwOjM4LjAwMDAwMFoiLCJHSFNBLXA3anEtdjhqcC1qNDI0Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-208/?cursor=WyIyMDIxLTA0LTE5VDE0OjUwOjM4LjAwMDAwMFoiLCJHSFNBLXA3anEtdjhqcC1qNDI0Il0>. Everything for agents: <https://agentprime.io/llms.txt>.