CWE-697.

HuangDou UTCMS Login login.php comparison

• HuangDou UTCMS
• CWE-697

In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison.

• CWE-697

NetAlertX has Password Bypass Vulnerability due to Loose Comparison in PHP

• jokob-sk NetAlertX
• CWE-697

SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation

• brainstormforce OttoKit: All-in-One Automation Platform
• CWE-697

TCPDF has incorrect comparison

• Memory corruption
• CWE-697

<6.8.0 · fixed in 6.8.0

`idna` accepts Punycode labels that do not produce any non-ASCII when decoded

• CWE-697
• CWE-1289

<1.0.0 · fixed in 1.0.0

PyJWT Issuer field partial matches allowed

• CWE-697

>=2.10.0, <2.10.1 · fixed in 2.10.1

Junos OS Evolved: Connections to the network and broadcast address accepted

• Juniper Networks Junos OS Evolved
• CWE-697

Owncast Cross-Site Request Forgery vulnerability in github.com/owncast/owncast

• Cross-site request forgery (CSRF)
• CWE-697

<0.1.3 · fixed in 0.1.3

Alpine allows Authentication Filter bypass

• Authentication bypass
• CWE-697

<1.10.4 · fixed in 1.10.4

Two-Factor Authentication (2FA) Bypass in mailcow: dockerized

• mailcow-dockerized
• CWE-697

Softaculous Webuzo Authentication Bypass

• Softaculous Webuzo
• CWE-697

Incorrect IPv4 and IPv6 private ranges

• Python Software Foundation CPython
• CWE-697

Authentication Bypass when using using older password hashes

• cacti
• Authentication bypass
• CWE-697

KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols

• CWE-184
• CWE-697

>=0.11.0, <0.16.10 · fixed in 0.16.10

planet-freo auth.inc.php comparison

• planet-freo
• CWE-697

Non-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin

• CWE-697

<688.v5fa · fixed in 688.v5fa

Jenkins Gogs Plugin uses non-constant time webhook token comparison

• CWE-208
• CWE-697

<=1.0.15 · no fixed version yet

Jenkins Multibranch Scan Webhook Trigger Plugin uses non-constant time webhook token comparison

• CWE-208
• CWE-697

<=1.0.9 · no fixed version yet

Non-constant time webhook token hash comparison in Jenkins Zanata Plugin

• CWE-208
• CWE-697

<=0.6 · no fixed version yet

Jenkins MSTeams Webhook Trigger Plugin uses non-constant time webhook token comparison

• CWE-208
• CWE-697

<=0.1.1 · no fixed version yet

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

• CWE-184
• CWE-697

<7.23.2 || >=8.0.0-alpha.0, <8.0.0-alpha.4 · fixed in 7.23.2, 8.0.0-alpha.4

gnark unsoundness in variable comparison / non-unique binary decomposition

• Memory corruption
• CWE-697

<0.9.0 · fixed in 0.9.0

MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers.

• CWE-697

Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

• GitHub Enterprise Server
• CWE-697

SolarWinds Platform Exposed Dangerous Method Vulnerability

• SolarWinds Platform
• CWE-697

SolarWinds Platform Exposed Dangerous Method Vulnerability

• SolarWinds Platform
• CWE-697

Non-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin

• CWE-697

>=378.380.v545b, <397.v907382dd9b || <378.vd6e2874a · fixed in 397.v907382dd9b, 378.vd6e2874a

Jenkins Google Login Plugin non-constant time token comparison

• CWE-697

<1.8 · fixed in 1.8

Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

• GitHub Enterprise Server
• CWE-697

Apache NiFi Insufficient Property Validation vulnerability

• CWE-184
• CWE-697

>=1.21.0, <1.23.1 · fixed in 1.23.1

Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

• GitHub Enterprise Server
• CWE-697

SolarWinds Platform Incorrect Comparison Vulnerability

• SolarWinds Platform
• CWE-697

SolarWinds Platform Deserialization of Untrusted Data Vulnerability

• SolarWinds Platform
• CWE-697

Server bad parsing implementation - stack overflow in server::get_db_path_for_driver

• Honeywell Experion Server
• Honeywell Experion Station
• CWE-697

Sentry CORS misconfiguration

• Broken access control
• CWE-697

>=23.6.0, <23.6.2 · fixed in 23.6.2

Apache OpenMeetings insufficient authorization vulnerability

• CWE-697

>=2.0.0, <7.1.0 · fixed in 7.1.0

Dynamic Linq vulnerable to remote code execution

• CWE-697

>=1.0.7.10, <1.3.0 · fixed in 1.3.0

An issue was discovered in ONOS 2.5.1.

• CWE-697

An issue was discovered in ONOS 2.5.1.

• CWE-697

Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

• GitHub Enterprise Server
• CWE-697

Incorrect comparison in D-Link DIR-1935

• D-Link DIR-1935
• CWE-697

TensorFlow has Floating Point Exception in AudioSpectrogram

• CWE-697

<2.11.1 · fixed in 2.11.1

TensorFlow has Floating Point Exception in AvgPoolGrad with XLA

• CWE-697

<2.11.1 · fixed in 2.11.1

TensorFlow has Floating Point Exception in TensorListSplit with XLA

• CWE-697

<2.11.1 · fixed in 2.11.1

TensorFlow has Segfault in Bincount with XLA

• CWE-697

<2.11.1 · fixed in 2.11.1

TensorFlow has Floating Point Exception in TFLite in conv kernel

• CWE-697

<2.11.1 · fixed in 2.11.1

A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.

• CWE-697

mrobit robitailletheknot CSRF Token filters.php comparison

• mrobit robitailletheknot
• CWE-697

An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6.

• CWE-697

SWFTools commit 772e55a2 was discovered to contain a floating point exception (FPE) via DCTStream::readMCURow() at /xpdf/Stream.cc.ow()

• CWE-697

uri-template-lite Regular Expression Denial of Service

• Denial of service
• CWE-697

<22.9.0 · fixed in 22.9.0

Regular expression denial of service in eth-account

• Denial of service
• CWE-697

<0.5.9 · fixed in 0.5.9

JetBrains Ktor before 2.1.0 was vulnerable to a Reflect File Download attack

• CWE-184
• CWE-697

<2.1.0 · fixed in 2.1.0

Junos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC reboot

• Juniper Networks Junos OS
• CWE-697

Codiad Vulnerable to PHP Magic Hash Vulnerability

• Authentication bypass
• CWE-697

<=2.8.4 · no fixed version yet

Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header

• CWE-697

<1.2.8 · fixed in 1.2.8

Incorrect Comparison in Vyper

• CWE-697

<0.3.2 · fixed in 0.3.2

Incorrect comparison in BIG-IP

• BIG-IP
• CWE-697

Incorrect Comparison in cvxopt

• CWE-697

<1.2.7 · fixed in 1.2.7