CWE-187: Partial String Comparison
The product performs a string comparison that only examines a portion of the string before determining whether there is a match.
A kind of CWE-1023 Incomplete Comparison with Missing Factors.
From the CWE List. © The MITRE Corporation.
Newest
- sgl-project sglang SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching 8.2 High
- brocade fabric os, broadcom fabric operating system +1 more An authentication logic and privilege escalation vulnerability exists in the account management... 5.9 Medium
- grpc grpc-node @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches 6.5 Medium
- dell openmanage server administrator, openmanage server administrator managed node (patch) for windows, openmanage server administrator managed node for rhel 8.10 +3 more +5 more Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String... 5.8 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 more Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation 7.5 High
- withastro astro Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base 6.3 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 more Windows HTTP Protocol Stack Tampering Vulnerability 6.5 Medium
- 666ghj bettafish 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison 6.9 Medium
- caddyserver caddy Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization 5.4 Medium
- github view component view_component: System Test Entry Point Path Check Allows Sibling Directory Escape 5.9 Medium
- jellyfin Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain 10.0 Critical
- rack, red hat satellite 6 +1 more Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching 7.5 High
- openwrt OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation 1.8 Low
- esphome, esphome firmware +1 more ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header 8.1 High
- siemens ruggedcom rm1224 lte(4g) eu, ruggedcom rm1224 lte(4g) nam, scalance m804pb +29 more +31 more A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All... 6.3 Medium
- docker moby Moby authz zero length regression 10.0 Critical
- ibm mq operator IBM MQ Container authentication bypass 8.1 High
- ibm mq operator IBM MQ Container denial of service 5.9 Medium
- codesys gateway server v2, gateway +1 more Partial string comparison in CODESYS gateway server 9.8 Critical
- chimurai http-proxy-middleware http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass 6.9 Medium