Falhas do tipo CWE-697

80 resultados

Comparação incorreta

O código compara valores ou objetos de forma inadequada, usando operadores errados ou não considerando o tipo de dados envolvido. Isso permite que condições de segurança sejam contornadas: um atacante entra onde não deveria porque a lógica de comparação não funciona como o desenvolvedor pretendia.

Exemplo

Um sistema valida acesso comparando a string do token com == em vez de usar comparação constante: se (token == tokenEsperado). Um atacante testa strings como '0' ou null que podem ser iguais por coerção de tipo, burlando a autenticação.

Como mitigar

Use operadores de comparação apropriados ao tipo (=== ou equals() em vez de ==), implemente comparação constante-time para valores sensíveis (HMAC ou funções específicas), e valide tipos explicitamente antes de comparar. Em java, use .equals() ou MessageDigest.isEqual(); em Python, use == com casting apropriado ou bibliotecas como secrets.compare_digest().

CVE-2020-15130HIGHFalse-positive validity for NFT1 genesis transactions in SLPJSEPSS 1.0%CVE-2024-41958MEDIUMTwo-Factor Authentication (2FA) Bypass in mailcow: dockerizedEPSS 1.0%CVE-2026-44249HIGHNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingEPSS 1.0%CVE-2022-24787HIGHIncorrect Comparison in VyperEPSS 1.0%CVE-2020-11071HIGHFalse-negative validation results in MINT transactions with invalid batonEPSS 0.9%CVE-2022-23027—On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 EPSS 0.9%CVE-2021-38364MEDIUMAn issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install orEPSS 0.8%CVE-2022-47034CRITICALA type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.EPSS 0.8%CVE-2024-53861LOWIssuer field partial matches allowed in pyjwtEPSS 0.8%CVE-2014-125057LOWmrobit robitailletheknot CSRF Token filters.php comparisonEPSS 0.8%CVE-2022-29944MEDIUMAn issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirectEPSS 0.8%CVE-2020-10024HIGHARM Platform Uses Signed Integer Comparison When Validating Syscall NumbersEPSS 0.7%CVE-2020-10027HIGHARC Platform Uses Signed Integer Comparison When Validating Syscall NumbersEPSS 0.7%CVE-2025-20343HIGHCisco Identity Services Engine Radius Suppression Denial of Service VulnerabilityEPSS 0.7%CVE-2024-39534MEDIUMJunos OS Evolved: Connections to the network and broadcast address acceptedEPSS 0.7%CVE-2023-23762MEDIUMIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingEPSS 0.6%CVE-2015-10129LOWplanet-freo auth.inc.php comparisonEPSS 0.6%CVE-2023-22435HIGH Server bad parsing implementation - stack overflow in server::get_db_path_for_driverEPSS 0.6%CVE-2023-23766MEDIUMIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingEPSS 0.6%CVE-2023-23764MEDIUMIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingEPSS 0.6%