CWE-697: Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect.
From the CWE List. © The MITRE Corporation.
Newest
- stellar rs-soroban-sdksoroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction5.3 Medium
- mmaitre314 picklescanpicklescan - Arbitrary Code Execution via profile.run() Blocklist Bypass9.3 Critical
- junkurihara httpsig-hyper, httpsig-rs +1 morehttpsig-hyper has Improper Digest Verification that May Allow Message Integrity Bypass7.5 High
hpke-rscrates.io,hpke-rs-rust-cryptocrates.io +1 moreBug fixes in hpke-rs, hpke-rs-rust-crypto8.2 High- color iccdeviccDEV has Type Confusion in CIccTag:IsTypeCompressed()5.4 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Radius Suppression Denial of Service Vulnerability8.6 High
- stellarwp the events calendarThe Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure5.3 Medium
- mantisbtMantisBT: Authentication bypass for some passwords due to PHP type juggling8.8 High
- dragonflyoss dragonflyTiming attacks against Proxy’s basic authentication are possible2.7 Low
- crestron touchscreen x60s, touchscreen x70 +1 moreConsoleFindCommandMatchList5.9 Medium
- huangdou utcmsHuangDou UTCMS Login login.php comparison6.3 Medium
- No product listedIn Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct...9.8 Critical
- ibm concert, concert software +1 moreIBM Concert Software cross-origin resource sharing5.4 Medium
- jokob-sk netalertxNetAlertX has Password Bypass Vulnerability due to Loose Comparison in PHP9.4 Critical
- pribai privategptZylon PrivateGPT settings.yaml cross-domain policy5.3 Medium
- brainstormforce ottokit: all-in-one automation platformSureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation8.1 High
- gitlabIncomplete Comparison with Missing Factors in GitLab3.5 Low
- tcpdf project tcpdfTCPDF has incorrect comparison7.5 High
- servo idna, rust-url +1 moreidna accepts Punycode labels that do not produce any non-ASCII when decoded5.1 Medium
- jpadilla pyjwtIssuer field partial matches allowed in pyjwt2.2 Low
- curlHSTS subdomain overwrites parent cache entry6.5 Medium
- juniper junos os evolvedJunos OS Evolved: Connections to the network and broadcast address accepted5.3 Medium
- getastra wp hardening, astrasecuritysuite wp hardening (discontinued) +1 moreWP Hardening – Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration5.3 Medium
- casbin casdoorGHSL-2024-035: Casdoor CORS misconfiguration8.1 High
- mailcow mailcow-dockerized, mailcow\ +1 moreTwo-Factor Authentication (2FA) Bypass in mailcow: dockerized6.6 Medium
- johnson controls exacqvision, johnsoncontrols exacqvision web service +1 moreexacqVision CORS6.8 Medium
- softaculous webuzoSoftaculous Webuzo Authentication Bypass9.8 Critical
- servicenow now platform, servicenow, servicenow utah, vancouver, and washington dc now platform +2 moreIncomplete Input Validation in GlideExpression Script9.2 Critical
- ibm mq operatorIBM MQ Container authentication bypass8.1 High
- hushline hush line, scidsg hushline +1 moreCSP bypass in Hush Line6.3 Medium
- python cpythonIncorrect IPv4 and IPv6 private ranges7.5 High
- dell policy manager for secure connect gateway, secure connect gateway (scg) policy manager, secure connect gateway policy manager +2 moreSCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy ...7.5 High
- linux, linux kernel +1 moremptcp: ensure tx skbs always have the MPTCP ext5.5 Medium
- cacti, fedoraproject fedora +1 moreAuthentication Bypass when using using older password hashes9.1 Critical
- bitdefender endpoint security for linux, endpoint security, gravityzone +3 more +5 moreIncorrect Regular Expression in GravityZone Update Server (VA-11465)8.1 High
- katexKaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols5.5 Medium
- owncastOwncast cross origin request8.2 High
- westermo lynx, l206-f2g firmware +1 moreWestermo Lynx Permissive Cross-domain Policy with Untrusted Domains6.6 Medium
- samwilson planet-freoplanet-freo auth.inc.php comparison3.7 Low
- ibm powerscIBM PowerSC cross-resource origin sharing5.3 Medium
- jenkins project gitlab branch source plugin, jenkins github branch source +1 moreNon-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin5.3 Medium
- espeak-ngEspeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function...5.5 Medium
- jenkins zanata, jenkins project zanata plugin +1 moreNon-constant time webhook token hash comparison in Jenkins Zanata Plugin5.3 Medium
- jenkins msteams webhook trigger, jenkins project msteams webhook trigger plugin +1 moreJenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison5.3 Medium
- jenkins gogs, jenkins project gogs plugin +1 moreJenkins Gogs Plugin uses non-constant time webhook token comparison5.3 Medium
- jenkins multibranch scan webhook trigger, jenkins project multibranch scan webhook trigger plugin +1 moreJenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison5.3 Medium
- lcdf gifsiclegifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream...7.8 High
- babel, babeljs babel-plugin-polyfill-corejs2, babel-plugin-polyfill-corejs3 +6 more +8 moreBabel vulnerable to arbitrary code execution when compiling specifically crafted malicious code9.4 Critical
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking8.1 High
- consensys gnarkgnark vulnerable to unsoundness in variable comparison/non-unique binary decomposition7.1 High
- Show moreLoading…