CWE-203
AllowedObservable Discrepancy
Abstraction: Base · Status: Incomplete
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
903 vulnerabilities reference this CWE, most recent first.
GHSA-842W-XCC3-C388
Vulnerability from github – Published: 2022-08-13 00:00 – Updated: 2022-08-16 00:00Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2022-2612"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-12T20:15:00Z",
"severity": "MODERATE"
},
"details": "Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.",
"id": "GHSA-842w-xcc3-c388",
"modified": "2022-08-16T00:00:23Z",
"published": "2022-08-13T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2612"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1321350"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-35"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-844F-662P-WHQ4
Vulnerability from github – Published: 2026-06-21 15:31 – Updated: 2026-06-21 15:31Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without authentication to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic for resource consumption.
{
"affected": [],
"aliases": [
"CVE-2026-56316"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-21T14:16:25Z",
"severity": "MODERATE"
},
"details": "Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without authentication to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic for resource consumption.",
"id": "GHSA-844f-662p-whq4",
"modified": "2026-06-21T15:31:24Z",
"published": "2026-06-21T15:31:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Cap-go/capgo/security/advisories/GHSA-9c2x-7h5x-37gm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56316"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/cap-go-job-existence-oracle-via-unauthenticated-options-build-upload-jobid"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-84J4-CCMW-HWPG
Vulnerability from github – Published: 2022-05-24 19:14 – Updated: 2024-03-21 03:34OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session.
{
"affected": [],
"aliases": [
"CVE-2016-20012"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-15T20:15:00Z",
"severity": "MODERATE"
},
"details": "OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH server, to test whether this suspicion is correct. This occurs because a challenge is sent only when that combination could be valid for a login session.",
"id": "GHSA-84j4-ccmw-hwpg",
"modified": "2024-03-21T03:34:06Z",
"published": "2022-05-24T19:14:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-20012"
},
{
"type": "WEB",
"url": "https://github.com/openssh/openssh-portable/pull/270"
},
{
"type": "WEB",
"url": "https://github.com/openssh/openssh-portable/pull/270#issuecomment-920577097"
},
{
"type": "WEB",
"url": "https://github.com/openssh/openssh-portable/pull/270#issuecomment-943909185"
},
{
"type": "WEB",
"url": "https://github.com/openssh/openssh-portable/blob/d0fffc88c8fe90c1815c6f4097bc8cbcabc0f3dd/auth2-pubkey.c#L261-L265"
},
{
"type": "WEB",
"url": "https://rushter.com/blog/public-ssh-keys"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20211014-0005"
},
{
"type": "WEB",
"url": "https://utcc.utoronto.ca/~cks/space/blog/tech/SSHKeysAreInfoLeak"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2018/08/24/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-84MH-M38Q-M9VH
Vulnerability from github – Published: 2024-06-18 21:30 – Updated: 2024-11-18 16:26A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Username Handler. The manipulation of the argument email leads to observable behavioral discrepancy. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268896.
{
"affected": [],
"aliases": [
"CVE-2024-6129"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-205"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-18T21:15:57Z",
"severity": "MODERATE"
},
"details": "A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Username Handler. The manipulation of the argument email leads to observable behavioral discrepancy. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268896.",
"id": "GHSA-84mh-m38q-m9vh",
"modified": "2024-11-18T16:26:45Z",
"published": "2024-06-18T21:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6129"
},
{
"type": "WEB",
"url": "https://msecureltd.blogspot.com/2024/04/friday-fun-pentest-series-5-spa.html"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2024/Jun/6"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.268896"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.268896"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8579-7P32-F398
Vulnerability from github – Published: 2024-01-03 16:13 – Updated: 2024-11-18 16:26A vulnerability was found during in the CubeFS master component that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords.
The vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component.
CubeFS has not seen any evidence of this being exploited in the wild. The vulnerability was found during a security audit conducted by Ada Logics in collaboration with OSTIF and the CNCF.
The issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/cubefs/cubefs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-46739"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-03T16:13:52Z",
"nvd_published_at": "2024-01-03T17:15:10Z",
"severity": "HIGH"
},
"details": "A vulnerability was found during in the CubeFS master component that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords.\n\nThe vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component. \n\nCubeFS has not seen any evidence of this being exploited in the wild. The vulnerability was found during a security audit conducted by [Ada Logics](https://adalogics.com/) in collaboration with [OSTIF](https://ostif.org/) and the [CNCF](https://www.cncf.io/).\n\nThe issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading. ",
"id": "GHSA-8579-7p32-f398",
"modified": "2024-11-18T16:26:34Z",
"published": "2024-01-03T16:13:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cubefs/cubefs/security/advisories/GHSA-8579-7p32-f398"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46739"
},
{
"type": "WEB",
"url": "https://github.com/cubefs/cubefs/commit/6a0d5fa45a77ff20c752fa9e44738bf5d86c84bd"
},
{
"type": "WEB",
"url": "https://github.com/cubefs/cubefs/commit/c21d034d2fcd051ffd64afeafc68cbcb39d26551"
},
{
"type": "PACKAGE",
"url": "https://github.com/cubefs/cubefs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L",
"type": "CVSS_V4"
}
],
"summary": "CubeFS timing attack can leak user passwords"
}
GHSA-86RQ-FJ99-CHHJ
Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks.
{
"affected": [],
"aliases": [
"CVE-2021-43398"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-04T21:15:00Z",
"severity": "MODERATE"
},
"details": "Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey(). There is a clear correlation between execution time and private key length, which may cause disclosure of the length information of the private key. This might allow attackers to conduct timing attacks.",
"id": "GHSA-86rq-fj99-chhj",
"modified": "2022-05-24T19:19:43Z",
"published": "2022-05-24T19:19:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43398"
},
{
"type": "WEB",
"url": "https://github.com/weidai11/cryptopp/issues/1080"
},
{
"type": "WEB",
"url": "https://github.com/weidai11/cryptopp/issues/1080#issuecomment-996492222"
},
{
"type": "WEB",
"url": "https://cryptopp.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-879H-24P2-CVV7
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-24 17:43Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2021-21173"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-09T18:15:00Z",
"severity": "MODERATE"
},
"details": "Side-channel information leakage in Network Internals in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.",
"id": "GHSA-879h-24p2-cvv7",
"modified": "2022-05-24T17:43:57Z",
"published": "2022-05-24T17:43:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21173"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1154250"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FE5SIKEVYTMDCC5OSXGOM2KRPYLHYMQX"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCIDZ77XUDMB2EBPPWCQXPEIJERDNSNT"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202104-08"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4886"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-88RC-96XJ-2MVH
Vulnerability from github – Published: 2024-06-20 12:31 – Updated: 2025-01-07 00:31In the Linux kernel, the following vulnerability has been resolved:
dma-buf: heaps: Fix potential spectre v1 gadget
It appears like nr could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory from being leaked to userspace via speculative execution by using array_index_nospec.
[sumits: added fixes and cc: stable tags]
{
"affected": [],
"aliases": [
"CVE-2022-48730"
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-20T12:15:11Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf: heaps: Fix potential spectre v1 gadget\n\nIt appears like nr could be a Spectre v1 gadget as it\u0027s supplied by a\nuser and used as an array index. Prevent the contents\nof kernel memory from being leaked to userspace via speculative\nexecution by using array_index_nospec.\n\n [sumits: added fixes and cc: stable tags]",
"id": "GHSA-88rc-96xj-2mvh",
"modified": "2025-01-07T00:31:39Z",
"published": "2024-06-20T12:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48730"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/24f8e12d965b24f8aea762589e0e9fe2025c005e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5d40f1bdad3dd1a177f21a90ad4353c1ed40ba3a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/92c4cfaee6872038563c5b6f2e8e613f9d84d47d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cc8f7940d9c2d45f67b3d1a2f2b7a829ca561bed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8934-73X5-7J23
Vulnerability from github – Published: 2022-05-24 17:14 – Updated: 2022-05-24 17:14wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks.
{
"affected": [],
"aliases": [
"CVE-2020-11713"
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-327"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-12T17:15:00Z",
"severity": "MODERATE"
},
"details": "wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks.",
"id": "GHSA-8934-73x5-7j23",
"modified": "2022-05-24T17:14:02Z",
"published": "2022-05-24T17:14:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11713"
},
{
"type": "WEB",
"url": "https://github.com/wolfSSL/wolfssl/pull/2894"
},
{
"type": "WEB",
"url": "https://gist.github.com/pietroborrello/7c5be2d1dc15349c4ffc8671f0aad04f"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-89P3-9J8C-FQH4
Vulnerability from github – Published: 2023-03-12 06:30 – Updated: 2026-02-03 17:38Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-gmrf-99gw-vvwj. This link is maintained to preserve external references.
Original Description
This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ezsystems/ezpublish-kernel"
},
"ranges": [
{
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.13.8.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ezsystems/ezpublish-kernel"
},
"ranges": [
{
"events": [
{
"introduced": "7.5.0"
},
{
"fixed": "7.5.15.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-13T20:58:01Z",
"nvd_published_at": "2023-03-12T05:15:00Z",
"severity": "MODERATE"
},
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-gmrf-99gw-vvwj. This link is maintained to preserve external references.\n\n## Original Description\n\nThis Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.",
"id": "GHSA-89p3-9j8c-fqh4",
"modified": "2026-02-03T17:38:51Z",
"published": "2023-03-12T06:30:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-gmrf-99gw-vvwj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46876"
},
{
"type": "WEB",
"url": "https://github.com/ezsystems/ezpublish-kernel/commit/b496f073c3f03707d3531a6941dc098b84e3cbed"
},
{
"type": "PACKAGE",
"url": "https://github.com/ezsystems/ezpublish-kernel"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel",
"withdrawn": "2026-02-03T17:38:51Z"
}
Mitigation MIT-46
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-39
- Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
- If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
- Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
CAPEC-189: Black Box Reverse Engineering
An adversary discovers the structure, function, and composition of a type of computer software through black box analysis techniques. 'Black Box' methods involve interacting with the software indirectly, in the absence of direct access to the executable object. Such analysis typically involves interacting with the software at the boundaries of where the software interfaces with a larger execution environment, such as input-output vectors, libraries, or APIs. Black Box Reverse Engineering also refers to gathering physical side effects of a hardware device, such as electromagnetic radiation or sounds.