Fallos del tipo CWE-697

112 resultados

Comparação Incorreta

Ocorre quando o código compara valores usando lógica errada — operador inadequado, tipos incompatíveis ou precedência de operadores mal interpretada — levando a decisões de segurança falharem silenciosamente. Um atacante pode contornar validações, autenticação ou verificações de autorização explorando essa lógica defeituosa.

Ejemplo

Um sistema valida senha fazendo `if (input == passwordHash)` em vez de usar função de comparação constante; ou verifica permissão com `if (userRole = 'admin')` (atribuição) em vez de `if (userRole == 'admin')` (comparação), permitindo bypass.

Cómo mitigar

Use operadores de comparação corretos (== vs = vs ===), implemente testes unitários que cobrem casos limítrofes, e para dados sensíveis (senhas, tokens) empregue funções de comparação timing-safe que não vazem informações por tempo de execução.

CVE-2026-92087HIGH@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed authEPSS 0.5%CVE-2026-73258MEDIUMMongoose: Multipart boundary/header scan logic error in mg_http_next_multipartEPSS 0.5%CVE-2026-20333HIGHCisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Comparison VulnerabilitiesEPSS 0.5%CVE-2026-91997MEDIUMevolution-api through 2.3.7 Prometheus Metrics IP Allowlist BypassEPSS 0.4%CVE-2025-9401MEDIUMHuangDou UTCMS Login login.php comparisonEPSS 0.4%CVE-2026-57222MEDIUMSuricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6EPSS 0.4%CVE-2026-18664HIGHWrong interpretation of ACL rangesEPSS 0.4%CVE-2024-29026HIGHOwncast cross origin requestEPSS 0.4%CVE-2024-28246MEDIUMKaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocolsEPSS 0.4%CVE-2026-59890MEDIUMsetuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+EPSS 0.4%CVE-2026-79913MEDIUMCloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addressesEPSS 0.4%CVE-2021-20219—A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local aEPSS 0.4%CVE-2026-50029MEDIUMjs-toml has silent type confusion via falsy-primitive duplicate-key bypassEPSS 0.4%CVE-2026-35040MEDIUMfast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)EPSS 0.4%CVE-2023-27579HIGHTensorFlow has Floating Point Exception in TFLite in conv kernelEPSS 0.4%CVE-2023-25669HIGHTensorFlow has Floating Point Exception in AvgPoolGrad with XLAEPSS 0.4%CVE-2023-25673HIGHTensorFlow has Floating Point Exception in TensorListSplit with XLA EPSS 0.4%CVE-2023-25675HIGHTensorFlow has Segfault in Bincount with XLAEPSS 0.4%CVE-2023-25666HIGHTensorFlow has Floating Point Exception in AudioSpectrogram EPSS 0.4%CVE-2026-101913MEDIUMip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hostsEPSS 0.4%