Weakness (CWE)
CWE-697: Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect.
Source: MITRE CWE-697
17 results · Clear filters · Feed
-
Critical 9.0
Certificate Name Authorization Bypass
Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authori…
-
Critical 9.1
@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
@fastify/proxy-addr is a Fastify plugin that determines a request's client address behind trusted reverse proxies, and it backs Fastify request.ip and request.ips. In versions 3.0.0 through 5.1.0, a trust subnet written in IPv4-mapped IPv6 notation with an IP…
-
Critical 9.1
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, …
-
Critical 9.8
MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET
MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos…
-
Critical 9.3
Kavita: Pre-Auth Account Takeover
Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unauthenticated threat actor to request a JWT for any user including admins given knowledge of their username. This vulnerability is fixed in 0…
-
Critical 9.1
Pingvin Share X: TOTP Authentication Bypass via Password-only Login
Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a critical authentication bypass vulnerability allows an attacker who has obtained a valid username and password to skip the second-factor authentication (TOTP) req…
-
Critical 9.8
In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed …
-
Critical 9.4
NetAlertX has Password Bypass Vulnerability due to Loose Comparison in PHP
NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions…
-
Critical 9.8
Softaculous Webuzo Authentication Bypass
Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user.
-
Critical 9.1
Authentication Bypass when using using older password hashes
Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying passw…
-
Critical 9.4
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution duri…
-
Critical 9.8
Dynamic Linq vulnerable to remote code execution
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.
-
Critical 9.8
A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass au…
-
Critical 9.8
Integria IMS incorrect authorization
Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in …
-
Critical 9.8
Incorrect Comparison in sodiumoxide
An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties.
-
Critical 9.1
Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
-
Critical 9.8
Timing attack on HMAC signature comparison in Apache Tapestry
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct sig…