Weaknesses of type CWE-697

80 results

Comparação incorreta

A fraqueza ocorre quando o código realiza comparações lógicas de forma imprecisa — usando operadores errados, comparando tipos incompatíveis ou ignorando casos especiais — resultando em decisões de segurança incorretas. Um atacante pode contornar validações ou controles de acesso explorando o desvio na lógica condicional.

Example

Um código valida senha comparando strings com '==' em vez de usar função de hash segura; ou verifica se um ID de usuário é válido com 'if (id > 0)' quando deveria validar contra uma lista branca específica. Em ambos os casos, a comparação rasa permite bypass de segurança.

How to mitigate

Use sempre funções apropriadas para cada tipo de comparação (ex: hash seguro para senhas, igualdade de tipo e valor com operadores estritos); implemente validação contra listas brancas explícitas; adicione testes unitários que cobram casos extremos e valores inesperados; revise a lógica condicional em controles de segurança durante code review.

CVE-2020-5849HIGHUnraid 6.8.0 allows authentication bypass.EPSS 93.2%KEVCVE-2020-8864HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-EPSS 80.2%CVE-2025-3102HIGHSureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User CreationEPSS 75.7%CVE-2020-8862HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC0EPSS 13.3%CVE-2023-23840MEDIUMSolarWinds Platform Exposed Dangerous Method VulnerabilityEPSS 5.4%CVE-2023-23845MEDIUMSolarWinds Platform Exposed Dangerous Method VulnerabilityEPSS 5.4%CVE-2023-33225HIGHSolarWinds Platform Deserialization of Untrusted Data VulnerabilityEPSS 3.2%CVE-2023-23843HIGHSolarWinds Platform Incorrect Comparison VulnerabilityEPSS 2.6%CVE-2022-43621HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. AutEPSS 2.2%CVE-2022-41317MEDIUMAn issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be ExposurEPSS 1.7%CVE-2015-9238—secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, EPSS 1.5%CVE-2023-28936MEDIUMApache OpenMeetings: insufficient check of invitation hashEPSS 1.2%CVE-2024-24621CRITICALSoftaculous Webuzo Authentication BypassEPSS 1.2%CVE-2021-3833CRITICALIntegria IMS incorrect authorizationEPSS 1.1%CVE-2024-34340CRITICALAuthentication Bypass when using using older password hashesEPSS 1.1%CVE-2021-0295MEDIUMJunos OS: QFX10K Series: Denial of Service (DoS) upon receipt of DVMRP packets received on multi-homing ESI in VXLAN.EPSS 1.1%CVE-2024-4032HIGHIncorrect IPv4 and IPv6 private rangesEPSS 1.1%CVE-2022-22203MEDIUMJunos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC rebootEPSS 1.1%CVE-2020-15131HIGHFalse-positive validity for NFT1 genesis transactions in SLP ValidateEPSS 1.0%CVE-2020-11072HIGHFalse-negative validation results in MINT transactions with invalid batonEPSS 1.0%