Weakness (CWE)
CWE-480: Use of Incorrect Operator
The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.
Source: MITRE CWE-480
4 results · Clear filters · Feed
-
High 7.3
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains…
-
High 7.5
Keystone: `graphql.maxTake` bypass with negative `take`
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to …
-
High 7.5
pf silently ignores certain rules
A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf…
-
High 7.5
Logic error in authentication in proxy.py
before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).