Weakness (CWE)
CWE-697: Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect.
Source: MITRE CWE-697
146 results · Feed
-
Medium 5.3
Incorrect Comparison in NumPy
An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless…
-
Critical 9.8
Integria IMS incorrect authorization
Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in …
-
High 7.5
Inefficient Regular Expression Complexity in nltk/nltk
nltk is vulnerable to Inefficient Regular Expression Complexity
-
Medium 5.3
Inefficient Regular Expression Complexity in josdejong/jsoneditor
jsoneditor is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Regular Expression Denial of Service in Leo Editor
Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.
-
High 7.5
Inefficient Regular Expression Complexity in chalk/ansi-regex
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in vuelidate/vuelidate
vuelidate is vulnerable to Inefficient Regular Expression Complexity
-
Medium 6.1
Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of DVMRP packets received on multi-homing ESI in VXLAN.
A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) of Juniper Networks Junos OS on the QFX10K Series switches allows an attacker to trigger a packet forwarding loop, leading to a partial Denial of Service (DoS). The issue is caused by D…
-
High 7.5
Incorrect Regular Expression in RestSharp
RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck proces…
-
High 7.5
Regular expression denial of service in react-native
A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
-
Unscored —
A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel. I…
-
High 7.5
Codiad Vulnerable to PHP Magic Hash Vulnerability
** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash …
-
High 7.5
Logic error in authentication in proxy.py
before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).
-
Critical 9.8
Incorrect Comparison in sodiumoxide
An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties.
-
High 7.5
False-positive validity for NFT1 genesis transactions in SLPJS
In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child…
-
High 7.5
False-positive validity for NFT1 genesis transactions in SLP Validate
In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly val…
-
Critical 9.1
Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
-
High 8.6
False-negative validation results in MINT transactions with invalid baton
In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the d…
-
High 8.6
False-negative validation results in MINT transactions with invalid baton
SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would resul…
-
High 7.8
ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers
An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephyrproject-rtos zephyr version 1.14.0 and later versions. version 2.1.0 and later versions.
-
High 7.8
ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers
The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zeph…
-
High 8.8CVE-2020-8864 EPSS 82%
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-8…
-
High 7.5
Unraid 6.8.0 allows authentication bypass.
KEV Nov 3, 2021 -
High 8.8CVE-2020-8862 EPSS 13%
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2…
-
Critical 9.8
Timing attack on HMAC signature comparison in Apache Tapestry
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct sig…
-
High —CVE-2015-9238 Public exploit
Insecure Comparison in secure-compare
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.