Incomplete Comparison with Missing Factors
CWE-1023
The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.
We track 7 vulnerabilities of this type. 86% are rated high or critical, and the average CVSS score is 7.5. 1 has been exploited in real attacks.
Latest Incomplete Comparison with Missing Factors vulnerabilities
- 8.1 High severity
Grafana Enterprise: Authentication Bypass by Spoofing
Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct ide
- 7.5 High severity
Dynamo: Incomplete Comparison with Missing Factors
NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache, where an attacker could cause a hash collision by submitting images that share an identical pixel byte sequence but have different dimensions. A successful exploit of this vuln
- 5.8 Medium severity
Arista Extensible Operating System Incomplete Comparison with Missing Factors Exploited
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward
- 7.5 High severity
FreeBSD: Use of Incorrect Operator
A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf.
- 9.1 Critical severity
jsrsasign: Incomplete Comparison with Missing Factors
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private
- 7.1 High severity
Ransomware Containment: Incomplete Comparison with Missing Factors
BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates file content based on header bytes. An authenticated attacker could encrypt files, preserving the first four bytes and
- 7.3 High severity
vllm: Incomplete Comparison with Missing Factors
vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Cu