CWE-697 · Input Validation and Logic
Incorrect Comparison
125CVEs
SortMost likely exploited
125 CVEs with CWE-697 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-5849In CISA KEVExploitedUnraid 6.8.0 allows authentication bypass.Unraid · Unraid · CVSS 7.5 · 2020-03-16 | 7.5 | 93% | 2020-03-16 |
| CVE-2025-3102CheckSureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypassbrainstormforce · OttoKit: All-in-One Automation Platform · CVSS 8.1 · 2025-04-10 | 8.1 | 76% | 2025-04-10 |
| CVE-2020-8864This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Auth…D-Link · Multiple Routers · CVSS 8.8 · 2020-03-23 | 8.8 | 82% | 2020-03-23 |
| CVE-2023-32571Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parse…Dynamic-Linq · Linq · 2023-06-22 | – | 35% | 2023-06-22 |
| CVE-2020-8862This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not requi…D-Link · DAP-2610 · CVSS 8.8 · 2020-02-22 | 8.8 | 13% | 2020-02-22 |
| CVE-2023-23845SolarWinds Platform Exposed Dangerous Method VulnerabilitySolarWinds · SolarWinds Platform · CVSS 6.8 · 2023-09-13 | 6.8 | 5.4% | 2023-09-13 |
| CVE-2023-23840SolarWinds Platform Exposed Dangerous Method VulnerabilitySolarWinds · SolarWinds Platform · CVSS 6.8 · 2023-09-13 | 6.8 | 5.4% | 2023-09-13 |
| CVE-2016-10003Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some p…Squid-Cache · Squid · 2017-01-27 | – | 4.8% | 2017-01-27 |
| CVE-2020-15811An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. Thi…Squid-Cache · Squid · 2020-09-02 | – | 3.8% | 2020-09-02 |
| CVE-2005-2801xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the name_index fields when sharing xattr blocks, which could prevent default ACLs from…Linux · Linux Kernel · 2005-09-06 | – | 3.4% | 2005-09-06 |
| CVE-2023-33225SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds · SolarWinds Platform · CVSS 7.2 · 2023-07-26 | 7.2 | 3.2% | 2023-07-26 |
| CVE-2021-35973NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to invoke any action by…Netgear · Wac104 Firmware · CVSS 9.8 · 2021-06-30 | 9.8 | 3.1% | 2021-06-30 |
| CVE-2023-23843SolarWinds Platform Incorrect Comparison VulnerabilitySolarWinds · SolarWinds Platform · CVSS 7.2 · 2023-07-26 | 7.2 | 2.6% | 2023-07-26 |
| CVE-2021-35970Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type.Voxmedia · Coral Talk · 2021-06-30 | – | 2.3% | 2021-06-30 |
| CVE-2022-43621This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit…D-Link · DIR-1935 · CVSS 8.8 · 2023-03-29 | 8.8 | 2.1% | 2023-03-29 |
| CVE-2021-44971Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain se…Tenda · Ac15 Firmware · 2022-01-28 | – | 2.1% | 2022-01-28 |
| CVE-2022-41317An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about client…Squid-Cache · Squid · CVSS 6.5 · 2022-12-25 | 6.5 | 1.8% | 2022-12-25 |
| CVE-2021-3116before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versu…Proxy.py Project · Proxy.py · 2021-01-11 | – | 1.7% | 2021-01-11 |
| CVE-2021-34141An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects.…Numpy · Numpy · 2021-12-17 | – | 1.7% | 2021-12-17 |
| CVE-2019-20634An issue was discovered in Proofpoint Email Protection through 2019-09-08. By collecting scores from Proofpoint email headers, it is possible to build a copy-cat Machine Learning…Proofpoint · Email Protection · CVSS 3.7 · 2020-03-30 | 3.7 | 1.6% | 2020-03-30 |
| CVE-2021-27293RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server r…Restsharp · Restsharp · 2021-07-12 | – | 1.5% | 2021-07-12 |
| CVE-2015-9238secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two st…HackerOne · secure-compare node module · 2018-05-31 | – | 1.4% | 2018-05-31 |
| CVE-2021-39917An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.…GitLab · GitLab · CVSS 4.3 · 2021-12-13 | 4.3 | 1.4% | 2021-12-13 |
| CVE-2020-13485The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.Verbb · Knock Knock · 2020-05-25 | – | 1.4% | 2020-05-25 |
| CVE-2020-23478Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.Leoeditor · Leo · 2021-09-22 | – | 1.2% | 2021-09-22 |
| CVE-2020-23360oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.ph…Oscommerce · Oscommerce · 2021-01-27 | – | 1.2% | 2021-01-27 |
| CVE-2020-23359WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two passwords. Two non-ide…Webidsupport · Webid · 2021-01-27 | – | 1.2% | 2021-01-27 |
| CVE-2023-28936Apache OpenMeetings: insufficient check of invitation hashApache Software Foundation · Apache OpenMeetings · CVSS 5.3 · 2023-05-12 | 5.3 | 1.2% | 2023-05-12 |
| CVE-2021-41500Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve)…Cvxopt Project · Cvxopt · 2021-12-17 | – | 1.2% | 2021-12-17 |
| CVE-2024-24621Softaculous Webuzo Authentication BypassSoftaculous · Webuzo · CVSS 9.8 · 2024-07-25 | 9.8 | 1.2% | 2024-07-25 |
| CVE-2021-37550In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.Jetbrains · Youtrack · 2021-08-06 | – | 1.1% | 2021-08-06 |
| CVE-2011-3903Google Chrome before 16.0.912.63 does not properly perform regex matching, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.Google · Chrome · 2011-12-13 | – | 1.1% | 2011-12-13 |
| CVE-2021-3833Integria IMS incorrect authorizationÁrtica · Integria IMS · CVSS 9.8 · 2021-10-07 | 9.8 | 1.1% | 2021-10-07 |
| CVE-2022-31650In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.Sound Exchange Project · Sound Exchange · 2022-05-25 | – | 1.1% | 2022-05-25 |
| CVE-2021-0295Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of DVMRP packets received on multi-homing ESI in VXLAN.Juniper Networks · Junos OS · CVSS 6.1 · 2021-07-15 | 6.1 | 1.1% | 2021-07-15 |
| CVE-2024-4032Incorrect IPv4 and IPv6 private rangesPython Software Foundation · CPython · CVSS 7.5 · 2024-06-17 | 7.5 | 1.1% | 2024-06-17 |
| CVE-2022-22203Junos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC rebootJuniper Networks · Junos OS · CVSS 6.5 · 2022-07-20 | 6.5 | 1.1% | 2022-07-20 |
| CVE-2020-22784In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could…Etherpad · Ueberdb · 2021-04-28 | – | 1.0% | 2021-04-28 |
| CVE-2020-15131False-positive validity for NFT1 genesis transactions in SLP Validatesimpleledger · slp-validate.js · CVSS 7.5 · 2020-07-30 | 7.5 | 1.0% | 2020-07-30 |
| CVE-2020-15130False-positive validity for NFT1 genesis transactions in SLPJSsimpleledger · slpjs · CVSS 7.5 · 2020-07-30 | 7.5 | 1.0% | 2020-07-30 |
| CVE-2020-11072False-negative validation results in MINT transactions with invalid batonsimpleledger · slp-validate · CVSS 8.6 · 2020-05-12 | 8.6 | 1.0% | 2020-05-12 |
| CVE-2024-41958Two-Factor Authentication (2FA) Bypass in mailcow: dockerizedmailcow · mailcow-dockerized · CVSS 6.6 · 2024-08-05 | 6.6 | 1.0% | 2024-08-05 |
| CVE-2022-24787Incorrect Comparison in Vypervyperlang · vyper · CVSS 7.5 · 2022-04-04 | 7.5 | 1.0% | 2022-04-04 |
| CVE-2020-11071False-negative validation results in MINT transactions with invalid batonsimpleledger · slpjs · CVSS 8.6 · 2020-05-12 | 8.6 | 0.9% | 2020-05-12 |
| CVE-2022-23027On BIG-IP versions 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, 13.1.x beginning in 13.1.3.6, 12.1.5.3-12.1.6, and 11.6.5.2, when a FastL4 profile and an HTTP, FIX, and/or hash p…F5 · BIG-IP · 2022-01-25 | – | 0.9% | 2022-01-25 |
| CVE-2021-40562A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enqueue_or_dispatch function in reframe_nalu.c, which causes a…Gpac · Gpac · 2022-01-12 | – | 0.9% | 2022-01-12 |
| CVE-2014-125057mrobit robitailletheknot CSRF Token filters.php comparisonmrobit · robitailletheknot · CVSS 3.1 · 2023-01-07 | 3.1 | 0.9% | 2023-01-07 |
| CVE-2021-39514An issue was discovered in libjpeg through 2020021. An uncaught floating point exception in the function ACLosslessScan::ParseMCU() located in aclosslessscan.cpp. It allows an att…Jpeg · Libjpeg · 2021-09-20 | – | 0.9% | 2021-09-20 |
| CVE-2021-38364An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of flow rules installed by intents. A remote attacker can install or remove a new intent, and consequently…Opennetworking · Onos · CVSS 6.5 · 2023-04-20 | 6.5 | 0.8% | 2023-04-20 |
| CVE-2022-47034A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.Playsms · Playsms · CVSS 9.8 · 2023-02-13 | 9.8 | 0.8% | 2023-02-13 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.