CWE-697 · Incorrect Comparison (page 2)
Page 2 of 2 — CVEs classified under CWE-697, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-125057 | Low | 3.1 | 2023-01-07 | A vulnerability was found in mrobit robitailletheknot. It has been classified as problematic. This affects an unknown part of the file app/filters.php of the c… |
CVE-2022-23554 | Medium | 6.5 | 2022-12-28 | Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI… |
CVE-2022-41317 | Medium | 6.5 | 2022-12-25 | An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Info… |
CVE-2022-4293 | Medium | 5.5 | 2022-12-05 | Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. |
CVE-2022-39308 | Medium | 6.5 | 2022-10-14 | GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD version… |
CVE-2022-35091 | Medium | 5.5 | 2022-09-23 | SWFTools commit 772e55a2 was discovered to contain a floating point exception (FPE) via DCTStream::readMCURow() at /xpdf/Stream.cc.ow() |
CVE-2022-35962 | High | 8.0 | 2022-08-29 | Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version 27.189, a crafted link in a message sen… |
CVE-2022-38230 | Medium | 5.5 | 2022-08-16 | XPDF commit ffaf11c was discovered to contain a floating point exception (FPE) via DCTStream::decodeImage() at /xpdf/Stream.cc. |
CVE-2022-36148 | Medium | 5.5 | 2022-08-16 | fdkaac commit 53fe239 was discovered to contain a floating point exception (FPE) via wav_open at /src/wav_reader.c. |
CVE-2022-35434 | Medium | 5.5 | 2022-08-16 | jpeg-quantsmooth before commit 8879454 contained a floating point exception (FPE) via /jpeg-quantsmooth/jpegqs+0x4f5d6c. |
CVE-2022-34999 | Medium | 5.5 | 2022-08-16 | JPEGDEC commit be4843c was discovered to contain a FPE via DecodeJPEG at /src/jpeg.inl. |
CVE-2022-38179 | Medium | 4.7 | 2022-08-12 | JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack |
CVE-2022-22203 | Medium | 6.5 | 2022-07-20 | An Incorrect Comparison vulnerability in PFE of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS). On QF… |
CVE-2021-27786 | Medium | 4.6 | 2022-06-09 | Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifie… |
CVE-2022-26691 | Medium | 6.7 | 2022-05-26 | A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5… |
CVE-2022-31650 | Medium | 5.5 | 2022-05-25 | In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a. |
CVE-2022-20072 | Medium | 6.7 | 2022-04-11 | In search engine service, there is a possible way to change the default search engine due to an incorrect comparison. This could lead to local escalation of pr… |
CVE-2022-24787 | High | 7.5 | 2022-04-04 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting i… |
CVE-2021-44971 | Critical | 9.8 | 2022-01-28 | Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an at… |
CVE-2022-23027 | Medium | 5.3 | 2022-01-25 | On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 profile and an HTTP… |
CVE-2021-34865 | High | 8.8 | 2022-01-25 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not requ… |
CVE-2022-22990 | High | 7.8 | 2022-01-13 | A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cl… |
CVE-2021-40562 | Medium | 5.5 | 2022-01-12 | A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enqueue_or_dispatch function in reframe_nal… |
CVE-2021-44078 | High | 8.1 | 2021-12-26 | An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obt… |
CVE-2021-41500 | High | 7.5 | 2021-12-17 | Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvx… |
CVE-2021-34141 | Medium | 5.3 | 2021-12-17 | An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing speci… |
CVE-2021-39917 | Medium | 4.3 | 2021-12-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio… |
CVE-2021-23146 | High | 7.1 | 2021-11-18 | An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification. This issue affects: Gall… |
CVE-2021-3833 | Critical | 9.8 | 2021-10-07 | Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. A… |
CVE-2021-3828 | High | 7.5 | 2021-09-27 | nltk is vulnerable to Inefficient Regular Expression Complexity |
CVE-2020-23478 | High | 7.5 | 2021-09-22 | Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py. |
CVE-2021-39514 | Medium | 6.5 | 2021-09-20 | An issue was discovered in libjpeg through 2020021. An uncaught floating point exception in the function ACLosslessScan::ParseMCU() located in aclosslessscan.c… |
CVE-2021-1904 | Medium | 6.2 | 2021-09-08 | Child process can leak information from parent process due to numeric pids are getting compared and these pid can be reused in Snapdragon Auto, Snapdragon Comp… |
CVE-2021-32779 | High | 8.6 | 2021-08-24 | Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled… |
CVE-2021-37550 | High | 7.5 | 2021-08-06 | In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used. |
CVE-2021-0295 | Medium | 6.1 | 2021-07-15 | A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) of Juniper Networks Junos OS on the QFX10K Series switches allows an attacker to trig… |
CVE-2021-27293 | High | 7.5 | 2021-07-12 | RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into Date… |
CVE-2021-35973 | Critical | 9.8 | 2021-06-30 | NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to… |
CVE-2021-35970 | High | 7.5 | 2021-06-30 | Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an… |
CVE-2021-23999 | High | 8.8 | 2021-06-24 | If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should… |
CVE-2020-1920 | High | 7.5 | 2021-06-01 | A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unres… |
CVE-2020-22784 | High | 7.5 | 2021-04-28 | In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's My… |
CVE-2020-25580 | Medium | 5.3 | 2021-03-26 | In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access(5) rule p… |
CVE-2021-20219 | Medium | 5.5 | 2021-03-23 | A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local attacker with a norm… |
CVE-2020-23360 | Critical | 9.8 | 2021-01-27 | oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/adm… |
CVE-2020-23359 | Critical | 9.8 | 2021-01-27 | WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two pa… |
CVE-2020-13559 | High | 7.5 | 2021-01-11 | A denial-of-service vulnerability exists in the traffic-logging functionality of FreyrSCADA IEC-60879-5-104 Server Simulator 21.04.028. A specially crafted pac… |
CVE-2021-3116 | High | 7.5 | 2021-01-11 | before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean… |
CVE-2019-20925 | High | 7.5 | 2020-11-24 | An unauthenticated client can trigger denial of service by issuing specially crafted wire protocol messages, which cause the message decompressor to incorrectl… |
CVE-2020-25696 | High | 7.5 | 2020-11-23 | A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5… |
CVE-2020-15811 | Medium | 6.5 | 2020-09-02 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP an… |
CVE-2020-15131 | High | 7.5 | 2020-07-30 | In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis tran… |
CVE-2020-15130 | High | 7.5 | 2020-07-30 | In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type… |
CVE-2020-13485 | Critical | 9.1 | 2020-05-25 | The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. |
CVE-2020-11072 | High | 8.6 | 2020-05-12 | In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT transaction operations. A p… |
CVE-2020-11071 | High | 8.6 | 2020-05-12 | SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validation outcomes for MINT transaction opera… |
CVE-2020-10027 | High | 7.8 | 2020-05-11 | An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. See NCC-ZEP-001 This issue affects: zephy… |
CVE-2020-10024 | High | 7.8 | 2020-05-11 | The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has obtained code execution within a user… |
CVE-2020-1741 | Medium | 5.9 | 2020-04-24 | A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installati… |
CVE-2019-20634 | Low | 3.7 | 2020-03-30 | An issue was discovered in Proofpoint Email Protection through 2019-09-08. By collecting scores from Proofpoint email headers, it is possible to build a copy-c… |
CVE-2020-8864 | High | 8.8 | 2020-03-23 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with fi… |
CVE-2020-5849 | High | 7.5 | 2020-03-16 | Unraid 6.8.0 allows authentication bypass. |
CVE-2020-8862 | High | 8.8 | 2020-02-22 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authent… |
CVE-2015-9238 | Medium | 5.3 | 2018-05-31 | secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check p… |
CVE-2016-10003 | High | 7.5 | 2017-01-27 | Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenl… |
CVE-2011-3903 | | 2011-12-13 | Google Chrome before 16.0.912.63 does not properly perform regex matching, which allows remote attackers to cause a denial of service (out-of-bounds read) via… | |
CVE-2005-2801 | High | 7.5 | 2005-09-06 | xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the name_index fields when sharing xattr blocks, which could preve… |