Weakness (CWE)
CWE-783: Operator Precedence Logic Error
The product uses an expression in which operator precedence causes incorrect logic to be used.
How to prevent it (1 mitigation)
-
Implementation
Regularly wrap sub-expressions in parentheses, especially in security-critical code.
Source: MITRE CWE-783
23 results · Feed
-
Medium 5.4
mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList
mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELET…
-
Medium 4.3
mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList
mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can …
-
Medium 6.1
DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS fu…
-
High 7.8CVE-2026-7270 Public exploit
Local privilege escalation via execve()
An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges.
-
Medium 6.9
Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than …
-
High 7.1
PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.
-
Medium 5.5
A logic error was addressed with improved error handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.…
-
Low 2.1
Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methods
Zincati is an auto-update agent for Fedora CoreOS hosts. Zincati ships a polkit rule which allows the `zincati` system user to use the actions `org.projectatomic.rpmostree1.deploy` to deploy updates to the system and `org.projectatomic.rpmostree1.finalize-dep…
-
Medium 5.5
In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a l…
-
Critical 10.0
In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergency services …
-
High 8.6
A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edg…
-
High 7.4
In ppmp_unprotect_buf of drm/code/drm_fw.c, there is a possible memory corruption due to a logic error in the code. Thi…
-
High 7.8CVE-2024-34741 Public exploit
In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be vi…
-
High 7.5
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sonoma 14.4, macOS Ventura 13.7. A…
-
High 7.8
In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error in the code. This c…
-
Medium 5.3
In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from bac…
-
High 7.4
In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_ZygoteCommandBuffer.cpp,…
-
High 7.8
In setMimeGroup of PackageManagerService.java, there is a possible way to hide the service from Settings due to a logic…
-
High 8.4
In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in t…
-
High 7.8
In multiple locations, there is a possible way in which policy migration code will never be executed due to a logic err…
-
High 8.1CVE-2024-32896 Exploited
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege wi…
KEV Jun 13, 2024 -
High 8.6
A vulnerability in the IPv4 Software-Defined Access (SD-Access) fabric edge node feature of Cisco IOS XE Software could…
-
High 7.8
In shouldHideNotification of KeyguardNotificationVisibilityProvider.kt, there is a possible way to show hidden notifica…