Weaknesses of type CWE-697

80 results

Comparação incorreta

A fraqueza ocorre quando o código realiza comparações lógicas de forma imprecisa — usando operadores errados, comparando tipos incompatíveis ou ignorando casos especiais — resultando em decisões de segurança incorretas. Um atacante pode contornar validações ou controles de acesso explorando o desvio na lógica condicional.

Example

Um código valida senha comparando strings com '==' em vez de usar função de hash segura; ou verifica se um ID de usuário é válido com 'if (id > 0)' quando deveria validar contra uma lista branca específica. Em ambos os casos, a comparação rasa permite bypass de segurança.

How to mitigate

Use sempre funções apropriadas para cada tipo de comparação (ex: hash seguro para senhas, igualdade de tipo e valor com operadores estritos); implemente validação contra listas brancas explícitas; adicione testes unitários que cobram casos extremos e valores inesperados; revise a lógica condicional em controles de segurança durante code review.

CVE-2020-15130HIGHFalse-positive validity for NFT1 genesis transactions in SLPJSEPSS 1.0%CVE-2024-41958MEDIUMTwo-Factor Authentication (2FA) Bypass in mailcow: dockerizedEPSS 1.0%CVE-2026-44249HIGHNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingEPSS 1.0%CVE-2022-24787HIGHIncorrect Comparison in VyperEPSS 1.0%CVE-2020-11071HIGHFalse-negative validation results in MINT transactions with invalid batonEPSS 0.9%CVE-2022-23027—On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 EPSS 0.9%CVE-2021-38364MEDIUMAn issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install orEPSS 0.8%CVE-2022-47034CRITICALA type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.EPSS 0.8%CVE-2024-53861LOWIssuer field partial matches allowed in pyjwtEPSS 0.8%CVE-2014-125057LOWmrobit robitailletheknot CSRF Token filters.php comparisonEPSS 0.8%CVE-2022-29944MEDIUMAn issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirectEPSS 0.8%CVE-2020-10024HIGHARM Platform Uses Signed Integer Comparison When Validating Syscall NumbersEPSS 0.7%CVE-2020-10027HIGHARC Platform Uses Signed Integer Comparison When Validating Syscall NumbersEPSS 0.7%CVE-2025-20343HIGHCisco Identity Services Engine Radius Suppression Denial of Service VulnerabilityEPSS 0.7%CVE-2024-39534MEDIUMJunos OS Evolved: Connections to the network and broadcast address acceptedEPSS 0.7%CVE-2023-23762MEDIUMIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingEPSS 0.6%CVE-2015-10129LOWplanet-freo auth.inc.php comparisonEPSS 0.6%CVE-2023-22435HIGH Server bad parsing implementation - stack overflow in server::get_db_path_for_driverEPSS 0.6%CVE-2023-23766MEDIUMIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingEPSS 0.6%CVE-2023-23764MEDIUMIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingEPSS 0.6%