Fallos del tipo CWE-697

103 resultados

Comparação Incorreta

Ocorre quando o código compara valores usando lógica errada — operador inadequado, tipos incompatíveis ou precedência de operadores mal interpretada — levando a decisões de segurança falharem silenciosamente. Um atacante pode contornar validações, autenticação ou verificações de autorização explorando essa lógica defeituosa.

Ejemplo

Um sistema valida senha fazendo `if (input == passwordHash)` em vez de usar função de comparação constante; ou verifica permissão com `if (userRole = 'admin')` (atribuição) em vez de `if (userRole == 'admin')` (comparação), permitindo bypass.

Cómo mitigar

Use operadores de comparação corretos (== vs = vs ===), implemente testes unitários que cobrem casos limítrofes, e para dados sensíveis (senhas, tokens) empregue funções de comparação timing-safe que não vazem informações por tempo de execução.

CVE-2020-11072HIGHFalse-negative validation results in MINT transactions with invalid batonEPSS 1.0%CVE-2022-24787HIGHIncorrect Comparison in VyperEPSS 1.0%CVE-2024-41958MEDIUMTwo-Factor Authentication (2FA) Bypass in mailcow: dockerizedEPSS 1.0%CVE-2026-44249HIGHNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingEPSS 1.0%CVE-2020-11071HIGHFalse-negative validation results in MINT transactions with invalid batonEPSS 0.9%CVE-2022-23027—On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 EPSS 0.9%CVE-2021-38364MEDIUMAn issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install orEPSS 0.8%CVE-2024-53861LOWIssuer field partial matches allowed in pyjwtEPSS 0.8%CVE-2022-47034CRITICALA type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.EPSS 0.8%CVE-2014-125057LOWmrobit robitailletheknot CSRF Token filters.php comparisonEPSS 0.8%CVE-2022-29944MEDIUMAn issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirectEPSS 0.8%CVE-2020-10027HIGHARC Platform Uses Signed Integer Comparison When Validating Syscall NumbersEPSS 0.7%CVE-2020-10024HIGHARM Platform Uses Signed Integer Comparison When Validating Syscall NumbersEPSS 0.7%CVE-2025-20343HIGHCisco Identity Services Engine Radius Suppression Denial of Service VulnerabilityEPSS 0.7%CVE-2024-39534MEDIUMJunos OS Evolved: Connections to the network and broadcast address acceptedEPSS 0.7%CVE-2023-23762MEDIUMIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingEPSS 0.6%CVE-2015-10129LOWplanet-freo auth.inc.php comparisonEPSS 0.6%CVE-2023-23765MEDIUMIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingEPSS 0.6%CVE-2026-22660HIGHFlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX EndpointEPSS 0.6%CVE-2023-22435HIGH Server bad parsing implementation - stack overflow in server::get_db_path_for_driverEPSS 0.6%