CWE-1025: Comparison Using Wrong Factors
The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities.
A kind of CWE-697 Incorrect Comparison.
From the CWE List. © The MITRE Corporation.
Newest
- hickory-dns Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision 8.2 High
- mongodb c# driver Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache 7.6 High
- fedoraproject sssd, red hat enterprise linux 10, enterprise linux 6 +7 more +9 more Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation 6.8 Medium
- rattadan cosmowarp contract The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value... 8.4 High
- brocade sannav Logic flaw in SANnav Java cache key handling object comparison handling 6.9 Medium
- apache software foundation tomcat Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout 7.5 High
- openstack blazar In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization... 7.2 High
- cyberpanel CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves... 7.7 High
- No product listed Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically 9.8 Critical
- arcadedata arcadedb ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex 8.7 High
- stoatchat stoatchat before 20250210-1 Unrestricted Message History Fetch 8.7 High
- red hat build of keycloak 26.4, build of keycloak 26.4.13, build of keycloak 26.4.14 +8 more +10 more Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison 8.1 High
- erlang otp, erlang\/otp, erlang\/ssl +2 more Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist 7.5 High
- zcashfoundation zebra-consensus, zebrad +1 more Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks 7.2 High
- systemd In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call... 6.2 Medium
- color iccdev iccDEV has Type Confusion in CIccTag:IsTypeCompressed() 5.4 Medium
- haproxy HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap... 6.8 Medium
- amazon tough Improper timestamp caching during snapshot rollback in tough 5.7 Medium
- amazon tough Failure to detect delegated target rollback in tough 5.7 Medium
- misskey Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes 9.3 Critical
- redwoodjs sdk operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic... 3.2 Low
- cisco firepower threat defense software, snort, secure firewall threat defense +2 more Cisco Firepower Threat Defense Software Rate Filter Bypass Vulnerability 5.8 Medium
- pmmp pocketmine-mp PocketMine-MP before 5.3.1 Denial of Service via LoginPacket 8.7 High