Skip to content
OpenAdvisories

Weakness (CWE)

CWE-187: Partial String Comparison

Variant Incomplete

The product performs a string comparison that only examines a portion of the string before determining whether there is a match.

How to prevent it (1 mitigation)

  1. Testing

    Thoroughly test the comparison scheme before deploying code into production. Perform positive testing as well as negative testing.

Source: MITRE CWE-187

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-115646

    Partial String Comparison Vulnerability in HiRDB

    Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; H…

    Hitachi HiRDB Server Version 10 HiRDB Server with Additional Function Version 9 HiRDB Server with Additional Function Version 9(32)
  • Critical 10.0
    CVE-2026-35031 Public exploit

    Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain

    Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file exten…

    jellyfin jellyfin
  • Critical 10.0
    CVE-2024-41110 Public exploit EPSS 16%

    Moby authz zero length regression

    Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow an attacker to bypass authorization plugins (AuthZ) under specific circumstances…

    moby moby katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Critical 9.8
    CVE-2022-31802

    Partial string comparison in CODESYS gateway server

    In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding …

    CODESYS CODESYS Gateway Server V2 ICS / OT