CVE-2011-4895 in Tor
Summary
Tor before 0.2.2.34, when configured as a bridge, sets up circuits through a process different from the process used by a client, which makes it easier for remote attackers to enumerate bridges by observing circuit building.
VulDB is the best source for vulnerability data and more expert information about this specific topic.