Fallos del tipo CWE-697

80 resultados

Comparação Incorreta

Ocorre quando o código compara valores usando lógica errada — operador inadequado, tipos incompatíveis ou precedência de operadores mal interpretada — levando a decisões de segurança falharem silenciosamente. Um atacante pode contornar validações, autenticação ou verificações de autorização explorando essa lógica defeituosa.

Ejemplo

Um sistema valida senha fazendo `if (input == passwordHash)` em vez de usar função de comparação constante; ou verifica permissão com `if (userRole = 'admin')` (atribuição) em vez de `if (userRole == 'admin')` (comparação), permitindo bypass.

Cómo mitigar

Use operadores de comparação corretos (== vs = vs ===), implemente testes unitários que cobrem casos limítrofes, e para dados sensíveis (senhas, tokens) empregue funções de comparação timing-safe que não vazem informações por tempo de execução.

CVE-2020-5849HIGHUnraid 6.8.0 allows authentication bypass.EPSS 93.2%KEVCVE-2020-8864HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-EPSS 80.2%CVE-2025-3102HIGHSureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User CreationEPSS 75.7%CVE-2020-8862HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC0EPSS 13.3%CVE-2023-23840MEDIUMSolarWinds Platform Exposed Dangerous Method VulnerabilityEPSS 5.4%CVE-2023-23845MEDIUMSolarWinds Platform Exposed Dangerous Method VulnerabilityEPSS 5.4%CVE-2023-33225HIGHSolarWinds Platform Deserialization of Untrusted Data VulnerabilityEPSS 3.2%CVE-2023-23843HIGHSolarWinds Platform Incorrect Comparison VulnerabilityEPSS 2.6%CVE-2022-43621HIGHThis vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. AutEPSS 2.2%CVE-2022-41317MEDIUMAn issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be ExposurEPSS 1.7%CVE-2015-9238—secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, EPSS 1.5%CVE-2023-28936MEDIUMApache OpenMeetings: insufficient check of invitation hashEPSS 1.2%CVE-2024-24621CRITICALSoftaculous Webuzo Authentication BypassEPSS 1.2%CVE-2021-3833CRITICALIntegria IMS incorrect authorizationEPSS 1.1%CVE-2024-34340CRITICALAuthentication Bypass when using using older password hashesEPSS 1.1%CVE-2021-0295MEDIUMJunos OS: QFX10K Series: Denial of Service (DoS) upon receipt of DVMRP packets received on multi-homing ESI in VXLAN.EPSS 1.1%CVE-2024-4032HIGHIncorrect IPv4 and IPv6 private rangesEPSS 1.1%CVE-2022-22203MEDIUMJunos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC rebootEPSS 1.1%CVE-2020-15131HIGHFalse-positive validity for NFT1 genesis transactions in SLP ValidateEPSS 1.0%CVE-2020-11072HIGHFalse-negative validation results in MINT transactions with invalid batonEPSS 1.0%