← Back
CWE-697

167 CVEs • Abstraction: Pillar

Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

JSON object

Loading...

CVEs (167)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-8864
1Dlink
3Dir 867 Firmware
Dir 878 FirmwareDir 882 Firmware
Jun 17, 2026
Mar 23, 2020
N/A· v4
8.8 HIGH· v3
8.3 HIGH· v2
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit thi...Show more
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of empty passwords. An attacker can leverage this vulnerability to execute arbitrary code on the router. Was ZDI-CAN-9471.Show less
CVE-2020-5849
1Unraid
1Unraid
Jun 17, 2026
Mar 16, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Unraid 6.8.0 allows authentication bypass.
CVE-2020-8862
1Dlink
1Dap 2610 Firmware
Jun 17, 2026
Feb 22, 2020
N/A· v4
8.8 HIGH· v3
8.3 HIGH· v2
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The sp...Show more
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from the lack of proper password checking. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-10082.Show less
CVE-2015-9238
1Secure Compare Project
1Secure Compare
Nov 21, 2024
May 31, 2018
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.
CVE-2016-10003
1Squid Cache
1Squid
May 13, 2026
Jan 27, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for de...Show more
Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.Show less
CVE-2011-3903
1Google
1Chrome
Apr 29, 2026
Dec 13, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Google Chrome before 16.0.912.63 does not properly perform regex matching, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVE-2005-2801
1Linux
1Linux Kernel
Apr 16, 2026
Sep 6, 2005
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the name_index fields when sharing xattr blocks, which could prevent default ACLs from being applied.