Weaknesses of type CWE-697

112 results

Comparação incorreta

A fraqueza ocorre quando o código realiza comparações lógicas de forma imprecisa — usando operadores errados, comparando tipos incompatíveis ou ignorando casos especiais — resultando em decisões de segurança incorretas. Um atacante pode contornar validações ou controles de acesso explorando o desvio na lógica condicional.

Example

Um código valida senha comparando strings com '==' em vez de usar função de hash segura; ou verifica se um ID de usuário é válido com 'if (id > 0)' quando deveria validar contra uma lista branca específica. Em ambos os casos, a comparação rasa permite bypass de segurança.

How to mitigate

Use sempre funções apropriadas para cada tipo de comparação (ex: hash seguro para senhas, igualdade de tipo e valor com operadores estritos); implemente validação contra listas brancas explícitas; adicione testes unitários que cobram casos extremos e valores inesperados; revise a lógica condicional em controles de segurança durante code review.

CVE-2015-10129LOWplanet-freo auth.inc.php comparisonEPSS 0.6%CVE-2023-23765MEDIUMIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingEPSS 0.6%CVE-2026-22660HIGHFlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX EndpointEPSS 0.6%CVE-2026-64836HIGHICEcoder through 8.1 Path Traversal via Ineffective File::check() ConfinementEPSS 0.6%CVE-2026-56101MEDIUMOpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoSEPSS 0.6%CVE-2023-22435HIGH Server bad parsing implementation - stack overflow in server::get_db_path_for_driverEPSS 0.6%CVE-2025-48952CRITICALNetAlertX has Password Bypass Vulnerability due to Loose Comparison in PHPEPSS 0.6%CVE-2023-23764MEDIUMIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingEPSS 0.6%CVE-2022-35091MEDIUMSWFTools commit 772e55a2 was discovered to contain a floating point exception (FPE) via DCTStream::readMCURow() at /xpdf/Stream.cc.ow()EPSS 0.6%CVE-2026-61795MEDIUMCapsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validationEPSS 0.6%CVE-2026-55771HIGHCedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilitiesEPSS 0.6%CVE-2025-54336CRITICALIn Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, EPSS 0.5%CVE-2026-67207HIGHWolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreControllerEPSS 0.5%CVE-2026-48032HIGHHulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providersEPSS 0.5%CVE-2026-14687MEDIUM666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparisonEPSS 0.5%CVE-2015-6964MEDIUMMultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiEPSS 0.5%CVE-2026-34210MEDIUMmppx has Stripe charge credential replay via missing idempotency checkEPSS 0.5%CVE-2026-49846HIGHlibks has path traversal in kws HTTP parser via URI segment overflowEPSS 0.5%CVE-2024-23903MEDIUMJenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the pEPSS 0.5%CVE-2026-93957MEDIUMolivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparisonEPSS 0.5%