Weakness (CWE)
CWE-697: Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect.
Source: MITRE CWE-697
56 results · Clear filters · Feed
-
Medium 4.8
Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI. To do so, an attacker would need write access to the repository. This vulnerabili…
-
Medium 6.8
Sentry CORS misconfiguration vulnerability
Sentry is an error tracking and performance monitoring platform. Starting in version 23.6.0 and prior to version 23.6.2, the Sentry API incorrectly returns the `access-control-allow-credentials: true` HTTP header if the `Origin` request header ends with the `…
-
Medium 5.3
Apache OpenMeetings: insufficient check of invitation hash
Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
-
Medium 5.3
An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing inte…
-
Medium 6.5
An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote at…
-
Medium 6.5
Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff. To do so, an attacker would need write access to the repository and be able to correctly guess the target branch be…
-
Medium 6.5
Authentication bypass in Alpine
Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI to evaluate if the user is accessing the swagger endpoint. By accessing a URL with a path such as /…
-
Medium 6.5
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs,…
-
Medium 5.5
SWFTools commit 772e55a2 was discovered to contain a floating point exception (FPE) via DCTStream::readMCURow() at /xpd…
-
Medium 5.9
ReDoS in uri-template-lite URI.expand function
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the uri-template-lite npm package, when an attacker is able to supply arbitrary input to the "URI.expand" method
-
Medium 5.9
ReDoS in eth-account encode_structured_data function
An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method
-
Medium 4.7
JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack
JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack
-
Medium 6.5
Junos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC reboot
An Incorrect Comparison vulnerability in PFE of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS). On QFX5000 Series, and EX4600 and EX4650 platforms, the fxpc process will crash followed by the FPC reboo…
-
Medium 5.3
Incorrect Comparison in NumPy
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless…
-
Medium 5.3
Inefficient Regular Expression Complexity in josdejong/jsoneditor
jsoneditor is vulnerable to Inefficient Regular Expression Complexity
-
Medium 6.1
Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of DVMRP packets received on multi-homing ESI in VXLAN.
A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) of Juniper Networks Junos OS on the QFX10K Series switches allows an attacker to trigger a packet forwarding loop, leading to a partial Denial of Service (DoS). The issue is caused by D…