Weakness (CWE)
CWE-783: Operator Precedence Logic Error
The product uses an expression in which operator precedence causes incorrect logic to be used.
How to prevent it (1 mitigation)
-
Implementation
Regularly wrap sub-expressions in parentheses, especially in security-critical code.
Source: MITRE CWE-783
7 results · Clear filters · Feed
-
Medium 5.4
mall4j through 4.0 Operator Precedence Error Deletes Other Users' Cart Items via /p/shopCart/cleanExpiryProdList
mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELET…
-
Medium 4.3
mall4j through 4.0 Operator Precedence Error Exposes Other Users' Cart Items via /p/shopCart/expiryProdList
mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other shoppers' cart items due to an operator precedence error in the getShopCartExpiryItems SQL filter. Attackers with any storefront account can …
-
Medium 6.1
DOMPurify before 3.4.0 ADD_TAGS Function Bypasses FORBID_TAGS
DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS fu…
-
Medium 6.9
Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than …
-
Medium 5.5
A logic error was addressed with improved error handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.…
-
Medium 5.5
In onClick of MainClear.java, there is a possible way to trigger factory reset without explicit user consent due to a l…
-
Medium 5.3
In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from bac…