CWE-697 Incorrect Comparison
pillarThe product compares two entities in a security-relevant context, but the comparison is incorrect.
01
child weaknesses
More specific entries beneath this one.
02
vulnerabilities (222)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-5217US | critical9.8OT critical | KEV | ||
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable a… | ||||
| CVE-2020-5849US | high7.5OT critical | KEV | ||
Unraid 6.8.0 allows authentication bypass. | ||||
| CVE-2020-8864US | high8.8 | — | ||
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authe… | ||||
| CVE-2023-32571US | critical9.8 | Exploit | ||
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed… | ||||
| CVE-2019-10071US | critical9.8 | — | ||
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could le… | ||||
| CVE-2026-73309US | critical9.1 | Exploit | ||
XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting e… | ||||
| CVE-2025-20343US | high7.5 | Exploit | ||
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote atta… | ||||
| CVE-2021-44971US | critical9.8 | — | ||
Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sen… | ||||
| CVE-2021-35973US | critical9.8 | — | ||
NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to invoke any action by… | ||||
| CVE-2019-25002US | critical9.8 | — | ||
An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. generichash::Digest::eq compares itself to itself and thus has degenerate security properties. | ||||
| CVE-2020-8862US | high8.8 | — | ||
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not requir… | ||||
| CVE-2025-27909US | critical9.8 | — | ||
IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being lim… | ||||
| CVE-2024-41958US | high7.2 | Exploit | ||
mailcow: dockerized is an open source groupware/email suite based on docker. A vulnerability has been discovered in the two-factor authentication (2FA) mechanism. This flaw allows… | ||||
| CVE-2024-24621US | critical9.8 | — | ||
Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full… | ||||
| CVE-2024-39742US | critical9.8 | — | ||
IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vulnerability. IBM X-F… | ||||
| CVE-2024-2223US | critical9.8 | — | ||
An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This iss… | ||||
| CVE-2023-50940US | critical9.8 | — | ||
IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the doma… | ||||
| CVE-2022-47034US | critical9.8 | — | ||
A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication. | ||||
| CVE-2014-125057US | critical9.8 | — | ||
A vulnerability was found in mrobit robitailletheknot. It has been classified as problematic. This affects an unknown part of the file app/filters.php of the component CSRF Token H… | ||||
| CVE-2021-27786US | critical9.8 | — | ||
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is… | ||||
03
attack patterns (29)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan