目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-1395 类漏洞列表 46

CWE-1395 类弱点 46 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-1395 指软件依赖包含已知漏洞的第三方组件。攻击者常利用这些已知缺陷，通过注入恶意代码或触发远程执行，从而绕过应用防护并控制目标系统。开发者应建立严格的供应链安全机制，定期扫描依赖项以识别风险，及时更新或替换存在漏洞的库，并最小化引入的外部组件数量，从而有效降低因第三方代码缺陷导致的安全风险。

MITRE CWE 官方描述
CWE：CWE-1395 依赖易受攻击的第三方组件 (Dependency on Vulnerable Third-Party Component) 英文：该产品依赖一个包含一个或多个已知漏洞的第三方组件。 许多产品足够庞大或复杂，以至于其部分功能使用了由非产品创建者的第三方开发的库、模块或其他知识产权。例如，在某些硬件产品中，甚至整个操作系统可能都来自第三方供应商。无论这些组件是开源还是闭源，它们都可能包含公开已知的漏洞或隐藏的功能（如恶意软件），从而可能被对手利用以破坏该产品。
常见影响 (1)
Confidentiality, Integrity, Availability Varies by Context
The consequences vary widely, depending on the vulnerabilities that exist in the component; how those vulnerabilities can be "reached" by adversaries, as the exploitation paths and attack surface will vary depending on how the component is used; and the criticality of the privilege levels and featur…
缓解措施 (5)
Requirements, Policy In some industries such as healthcare [REF-1320] [REF-1322] or technologies such as the cloud [REF-1321], it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service. Clarifying roles and responsibilities can be important to minimize confusion or unnecessary delay when third-party vulnerabilities are di…
Requirements Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM) [REF-1247] [REF-1311].
Architecture and Design, Implementation, Integration, Manufacturing Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to [REF-1247], "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical relationships."
Operation, Patching and Maintenance Actively monitor when a third-party component vendor announces vulnerability patches; fix the third-party component as soon as possible; and make it easy for operators/customers to obtain and apply the patch.
Operation, Patching and Maintenance Continuously monitor changes in each of the product's components, especially when the changes indicate new vulnerabilities, end-of-life (EOL) plans, etc.
代码示例 (2)
The "SweynTooth" vulnerabilities in Bluetooth Low Energy (BLE) software development kits (SDK) were found to affect multiple Bluetooth System-on-Chip (SoC) manufacturers. These SoCs were used by many products such as medical devices, Smart Home devices, wearables, and other IoT devices. [REF-1314] [REF-1315]
log4j, a Java-based logging framework, is used in a large number of products, with estimates in the range of 3 billion affected devices [REF-1317]. When the "log4shell" (CVE-2021-44228) vulnerability was initially announced, it was actively exploited for remote code execution, requiring urgent mitigation in many organizations. However, it was unclear how many products were affected, as Log4j would…
CVE ID 标题 CVSS 风险等级 Published
CVE-2024-26293 Avid多款产品 安全漏洞 — Avid NEXIS E-series 9.8AI Critical AI 2025-07-14
CVE-2022-4976 Archive::Unzip::Burst 安全漏洞 — Archive::Unzip::Burst 8.8AI High AI 2025-06-12
CVE-2025-40912 Perl CryptX 安全漏洞 — CryptX 9.8AI Critical AI 2025-06-11
CVE-2025-40914 Perl CryptX 安全漏洞 — CryptX 9.8AI Critical AI 2025-06-11
CVE-2020-36846 MetaCPAN IO::Compress::Brotli 安全漏洞 — IO::Compress::Brotli 7.5AI High AI 2025-05-30
CVE-2025-40906 MetaCPAN BSON::XS 安全漏洞 — BSON::XS 9.8AI Critical AI 2025-05-16
CVE-2025-40907 fcgi2 安全漏洞 — FCGI 9.8AI Critical AI 2025-05-16
CVE-2024-12740 NI Vision 安全漏洞 — Vision Development Module 7.8 High 2025-01-27
CVE-2024-11948 GFI Archiver 安全漏洞 — Archiver 9.8 - 2024-12-11
CVE-2024-6121 NI SystemLink Server 安全漏洞 — SystemLink Server 7.8 High 2024-07-22
CVE-2024-32753 Johnson Controls Illustra Pro Gen 4 安全漏洞 — TYCO Illustra Pro4 Fixed cameras 9.1AI Critical AI 2024-07-11
CVE-2024-38526 pdoc 安全漏洞 — pdoc - High 2024-06-25
CVE-2024-5246 NETGEAR ProSAFE Network Management System 安全漏洞 — ProSAFE Network Management System 8.8AI High AI 2024-05-23
CVE-2024-21421 Microsoft Azure SDK 安全漏洞 — Azure SDK 7.5 High 2024-03-12
CVE-2024-0552 Intumit SmartRobot 安全漏洞 — SmartRobot 9.8 Critical 2024-01-15
CVE-2023-5332 GitLab 安全漏洞 — GitLab 5.9 Medium 2023-12-04

CWE-1395 是常见的弱点类别，本平台收录该类弱点关联的 46 条 CVE 漏洞。