CWE-697: Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect.
From the CWE List. © The MITRE Corporation.
Newest
- perforce puppet enterprise Certificate Name Authorization Bypass 9.0 Critical
- zoneminder ZoneMinder failed token handling bypasses web authentication 5.3 Medium
- itsmeravitejak online-examination-system itsmeravitejak Online-Examination-System Session session.php checkLogin comparison 6.9 Medium
- google chrome Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker... 8.8 High
- legion of the bouncy castle inc. bc-fja, bc-java +1 more CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys 6.9 Medium
- eclipse foundation threadx netx duo mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet 7.1 High
- beaugunderson ip-address ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts 6.3 Medium
- beaugunderson ip-address ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range 6.3 Medium
- invoiceplane InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth) 4.8 Medium
- cloudreve Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses 6.5 Medium
- olivier-ls php-fts olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison 5.3 Medium
- oisf suricata Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state 5.9 Medium
- projectcapsule capsule Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation 6.8 Medium
- projectcapsule capsule Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement 7.1 High
- unknown clean login Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison 5.3 Medium
- cisco secure firewall adaptive security appliance (asa) software, secure firewall management center (fmc), secure firewall threat defense (ftd) software +2 more Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Comparison Vulnerabilities 8.8 High
- @fastify/proxy-addr @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet 9.1 Critical
- @fastify/auth @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth 8.1 High
- evolution-foundation evolution-api evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass 6.9 Medium
- misp MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison 5.3 Medium
- proxy-addr proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet 9.1 Critical
- signalwire libks libks has path traversal in kws HTTP parser via URI segment overflow 7.5 High
- icecoder ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement 8.7 High
- openbsd OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS 6.0 Medium
- xenforo XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint 9.1 Critical
- ash-project ash sql SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql 2.1 Low
- nlnet labs nsd Wrong interpretation of ACL ranges 8.2 High
- automattic mongoose Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart 6.5 Medium
- memtensor memos MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET 9.3 Critical
- intel trust domain extensions guest Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3:... 4.6 Medium
- wolfcms Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController 8.7 High
- oisf suricata Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6 5.3 Medium
- cedar-policy cedar-java CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities 8.8 High
- flaskbb FlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX Endpoint 8.6 High
- pypa setuptools setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ 6.1 Medium
- 666ghj bettafish 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison 6.9 Medium
-
hdrhistogramDebian,cargoRed Hat,clippyRed Hat +19 more +21 more HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison 4.8 Medium - nousresearch hermes-agent NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity 2.3 Low
- sunnyadn js-toml js-toml has silent type confusion via falsy-primitive duplicate-key bypass 5.3 Medium
- wolfssl ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery 8.3 High
- sentriz gonic gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host 8.1 High
- roxy-wi Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug) 8.1 High
- roxy-wi Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt 8.3 High
- kerberosmansour hulumi Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers 8.3 High
- kareadita kavita Kavita: Pre-Auth Account Takeover 9.3 Critical
- nousresearch hermes-agent NousResearch hermes-agent CLI web-dashboard web_server.py _discover_dashboard_plugins comparison 4.8 Medium
- smp46 pingvin-share-x Pingvin Share X: TOTP Authentication Bypass via Password-only Login 9.1 Critical
- nearform fast-jwt fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) 5.3 Medium
- parse-community parse-server Parse Server: Session field immutability bypass via falsy-value guard 5.3 Medium
- wevm mppx mppx has Stripe charge credential replay via missing idempotency check 6.0 Medium
- Show olderLoading…