CWE-697 Incorrect Comparison
pillarThe product compares two entities in a security-relevant context, but the comparison is incorrect.
01
untergeordnete Schwächen
Spezifischere Einträge unterhalb dieses.
02
Schwachstellen (222)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-5217US | critical9.8OT kritisch | KEV | ||
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable a… | ||||
| CVE-2020-5849US | high7.5OT kritisch | KEV | ||
Unraid 6.8.0 allows authentication bypass. | ||||
| CVE-2020-8864US | high8.8 | — | ||
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authe… | ||||
| CVE-2023-32571US | critical9.8 | Exploit | ||
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed… | ||||
| CVE-2019-10071US | critical9.8 | — | ||
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could le… | ||||
| CVE-2026-73309US | critical9.1 | Exploit | ||
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting e… | ||||
| CVE-2025-20343US | high7.5 | Exploit | ||
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote atta… | ||||
| CVE-2021-44971US | critical9.8 | — | ||
Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sen… | ||||
| CVE-2021-35973US | critical9.8 | — | ||
NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to invoke any action by… | ||||
| CVE-2019-25002US | critical9.8 | — | ||
An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties. | ||||
| CVE-2020-8862US | high8.8 | — | ||
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not requir… | ||||
| CVE-2025-27909US | critical9.8 | — | ||
IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being lim… | ||||
| CVE-2024-41958US | high7.2 | Exploit | ||
mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows… | ||||
| CVE-2024-24621US | critical9.8 | — | ||
Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full… | ||||
| CVE-2024-39742US | critical9.8 | — | ||
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-F… | ||||
| CVE-2024-2223US | critical9.8 | — | ||
An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This iss… | ||||
| CVE-2023-50940US | critical9.8 | — | ||
IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the doma… | ||||
| CVE-2022-47034US | critical9.8 | — | ||
A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication. | ||||
| CVE-2014-125057US | critical9.8 | — | ||
A vulnerability was found in mrobit robitailletheknot. It has been classified as problematic. This affects an unknown part of the file app/filters.php of the component CSRF Token H… | ||||
| CVE-2021-27786US | critical9.8 | — | ||
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is… | ||||
03
Angriffsmuster (29)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan