CWE-208.

Apache Doris: Timing Attack weakness

• Apache Software Foundation Apache Doris
• CWE-208

m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657

• Information disclosure
• CWE-208

<=0.40.1 · no fixed version yet

Python Cryptography package vulnerable to Bleichenbacher timing oracle attack

• Information disclosure
• CWE-208

<42.0.0 · fixed in 42.0.0

Cryptlib: rsa key exchange ciphersuites in tls vulnerable to marvin attack

• CWE-208

Dell BSAFE Micro Edition Suite: Dell BSAFE Micro Edition Suite, versions before 4.5.2…

• Dell BSAFE Micro Edition Suite
• CWE-208

vantage6 vulnerable to username timing attack

• CWE-208

<4.2.0 · fixed in 4.2.0

Minerva timing attack on P-256 in python-ecdsa

• Information disclosure
• CWE-208

* · no fixed version yet

Potential Timing vulnerability in CBC PKCS7 padding calculations

• silabs.com GSDK
• Weak cryptography or TLS
• CWE-208

Gnutls: timing side-channel in the rsa-psk authentication

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 8.6 Extended Update Support
• CWE-208

generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character

• Authentication bypass
• CWE-208

<2.23.0 · fixed in 2.23.0

Jenkins Gogs Plugin uses non-constant time webhook token comparison

• CWE-208
• CWE-697

<=1.0.15 · no fixed version yet

Jenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison

• CWE-208
• CWE-697

<=1.0.9 · no fixed version yet

Non-constant time webhook token hash comparison in Jenkins Zanata Plugin

• CWE-208
• CWE-697

<=0.6 · no fixed version yet

Jenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison

• CWE-208
• CWE-697

<=0.1.1 · no fixed version yet

SK_LOAD timing side channel during AES module decryption in Texas Instruments OMAP L138

• Texas Instruments OMAP
• CWE-208

Harbor timing attack risk

• Race condition
• CWE-208

<1.10.18 || >=2.0.0, <2.7.3 || >=2.8.0, <2.8.3 · fixed in 1.10.18, 2.7.3, 2.8.3

NVIDIA DGX H100 BMC: NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon…

• NVIDIA DGX H100 BMC
• NVIDIA DGX A100 BMC
• CWE-208

silverware-io-issue-tracker server responds in a noticeably different amount of time depending if a given email address exists or not

• mesosoi silverwaregames-io-issue-tracker
• CWE-208

Timing Attack Reveals CSRF Tokens in oppia

• oppia
• Information disclosure
• CWE-208

Non-constant time HMAC comparison in Adyen plugin in Saleor

• saleor
• Information disclosure
• CWE-208

An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbit...

• CWE-208

<3.3.5 · fixed in 3.3.5

HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks

• Information disclosure
• CWE-208

<1.11.9 || >=1.12.0, <1.12.5 || >=1.13.0, <1.13.1 · fixed in 1.11.9, 1.12.5, 1.13.1

OpenSearch has time discrepancy in authentication responses

• Information disclosure
• CWE-208

<1.3.9 || >=2.0.0, <2.6.0 · fixed in 1.3.9, 2.6.0

Observable timing discrepancy in JOpenId

• Information disclosure
• CWE-208

<1.08 · fixed in 1.08

Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator

• Information disclosure
• CWE-208

<1.15.15.Final || >=1.16.0.CR1, <1.20.3.Final · fixed in 1.15.15.Final, 1.20.3.Final

NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may lead to an information disclosure.

• NVIDIA DGX servers
• CWE-208

Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy

• Information disclosure
• CWE-208

<2.0.1 · fixed in 2.0.1

Pylons horus services.py timing discrepancy

• Pylons horus
• CWE-208

Timing attack in github.com/openshift/osin

• CWE-208

<1.0.2-0.20210113124101-8612686d6dda · fixed in 1.0.2-0.20210113124101-8612686d6dda

Ziftr primecoin bitcoinrpc.cpp HTTPAuthorized timing discrepancy

• Ziftr primecoin
• CWE-208

InSTEDD Nuntium geopoll_controller.rb timing discrepancy

• InSTEDD Nuntium
• CWE-208

Non-constant time webhook token comparison in Jenkins GitLab Plugin

• Information disclosure
• CWE-208

<1.5.36 · fixed in 1.5.36

Non-constant time webhook token comparison in Jenkins Generic Webhook Trigger Plugin

• Information disclosure
• CWE-208

<1.84.2 · fixed in 1.84.2

GoCD API authentication of user access tokens subject to timing attack during comparison

• gocd
• CWE-208
• CWE-1254

Atlantis Events vulnerable to Timing Attack

• Information disclosure
• CWE-208

<0.19.7 · fixed in 0.19.7

Jenkins GitHub plugin uses weak webhook signature function

• Information disclosure
• CWE-208

<1.34.5 · fixed in 1.34.5

fastify-bearer-auth vulnerable to Timing Attack Vector

• Information disclosure
• CWE-208

<7.0.2 || >=8.0.0, <8.0.1 · fixed in 7.0.2, 8.0.1

Cisco Unified Communications Products Timing Attack Vulnerability

• Cisco Unified Communications Manager
• CWE-208

Observable timing discrepancy allows determining username validity in Jenkins

• Information disclosure
• CWE-208

>=2.334, <2.356 || <2.332.4 · fixed in 2.356, 2.332.4

Login timing attack in ibexa/core

• CWE-208

>=4.0.0, <4.0.7 || >=4.1.0, <4.1.4 · fixed in 4.0.7, 4.1.4

Login timing attack in ezsystems/ezpublish-kernel

• CWE-208

>=7.5.0, <7.5.29 · fixed in 7.5.29

Login timing attack in ezsystems/ezplatform-kernel

• CWE-208

>=1.3.0, <1.3.19 · fixed in 1.3.19

Non-constant time comparison of inbound TCP agent connection secret

• Information disclosure
• CWE-208

<2.204.2 || >=2.205, <2.219 · fixed in 2.204.2, 2.219

Non-constant time HMAC comparison

• Information disclosure
• CWE-208

<2.204.2 || >=2.205, <2.219 · fixed in 2.204.2, 2.219

Symfony Vulnerable to Timing Attack

• CWE-208

>=2.3.0, <2.3.35 || >=2.4.0, <2.6.12 || >=2.7.0, <2.7.7 · fixed in 2.3.35, 2.6.12, 2.7.7

Timing attack

• Information disclosure
• CWE-208

>=0.0.0-0, <1.1.0 · fixed in 1.1.0

Siemens RUGGEDCOM i800: A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802…

• Siemens RUGGEDCOM i800
• Siemens RUGGEDCOM i801
• CWE-208

Apache Hive Information Exposure and Observable Timing Discrepancy

• Information disclosure
• CWE-208

<2.3.8 · fixed in 2.3.8

The code that performs password matching when using 'Basic' HTTP authentication does not use a constant-time memcmp and has no rate-limiting.

• embedthis goahead
• CWE-208

Observable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin

• Information disclosure
• CWE-208

>=1.55, <1.55.1 || >=1.54, <1.54.1 || >=1.48, <1.53.1 || <1.47.1 · fixed in 1.55.1, 1.54.1, 1.53.1, 1.47.1

Side-channels Related to the x86 PREFETCH Instruction

• AMD All supported processors
• CWE-208

libsecp256k1 contains side-channel timing attack

• CWE-208

<0.3.1 · fixed in 0.3.1

Observable Timing Discrepancy in aaugustin websockets library

• Information disclosure
• CWE-208

<9.1 · fixed in 9.1

AMD Speculative execution with Floating-Point Value Injection

• AMD All supported processors
• CWE-208

AMD Speculative Code Store Bypass

• AMD All supported processors
• CWE-208

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

• Information disclosure
• CWE-208

<3.11.4 · fixed in 3.11.4

Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime

• Information disclosure
• CWE-208

<3.11.4 · fixed in 3.11.4

Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18

• Information disclosure
• CWE-208

>=1.0.0, <1.0.14 || >=1.1.0, <2.4.7 || >=3.0.0, <5.0.3 · fixed in 1.0.14, 2.4.7, 5.0.3

Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8

• Information disclosure
• CWE-208

>=7.0.0, <7.7.24 || >=8.0.0, <8.12.3 · fixed in 7.7.24, 8.12.3

Timing side channel vulnerability in endpoint request handler in Vaadin 15-19

• Information disclosure
• CWE-208

>=3.0.0, <5.0.4 || >=6.0.0, <6.0.1 · fixed in 5.0.4, 6.0.1