CWE-187 部分比较 类弱点 13 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-187 属于字符串比较漏洞，指程序仅比对部分字符串即判定匹配。攻击者常利用此缺陷，通过构造短小但包含正确子串的凭证（如密码片段）绕过身份验证或逻辑校验，从而获取非法访问权限。开发者应避免截断比较，确保对完整字符串进行精确比对，并采用恒定时间比较算法，以消除侧信道攻击风险，保障系统安全。
/* Ignore CWE-259 (hard-coded password) and CWE-309 (use of password system for authentication) for this example. */ char *username = "admin"; char *pass = "password"; int AuthenticateUser(char *inUser, char *inPass) { if (strncmp(username, inUser, strlen(inUser))) { logEvent("Auth failure of username using strlen of inUser"); return(AUTH_FAIL); } if (! strncmp(pass, inPass, strlen(inPass))) { logEvent("Auth success of password using strlen of inUser"); return(AUTH_SUCCESS); } else { logEvent("Auth fail of password using sizeof"); return(AUTH_FAIL); } } int main (int argc, char **argv) { int ap pa pas pass| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-81479 | Dell OpenManage 11.1.0.3前拒绝服务漏洞 — OpenManage Server Administrator Managed Node (Patch) for Windows | 5.8 | Medium | 2026-09-17 |
| CVE-2026-87853 | Red Hat SSSD 输入验证错误漏洞 — Red Hat Enterprise Linux 10 | 7.5 | High | 2026-09-09 |
| CVE-2026-84376 | withastro astro 输入验证错误漏洞 — astro | 6.3 | Medium | 2026-09-02 |
| CVE-2026-62750 | Microsoft Windows 输入验证错误漏洞 — Windows 10 Version 1607 | 6.5 | Medium | 2026-08-11 |
| CVE-2026-14687 | BaiFu BettaFish 输入验证错误漏洞 — BettaFish | 5.3 | Medium | 2026-07-05 |
| CVE-2026-45692 | caddyserver caddy 输入验证错误漏洞 — caddy | 5.4 | Medium | 2026-06-23 |
| CVE-2026-44837 | view_component 安全漏洞 — view_component | 5.9 | Medium | 2026-05-26 |
| CVE-2026-34785 | Rack 信息泄露漏洞 — rack | 7.5 | High | 2026-04-02 |
| CVE-2026-30874 | OpenWrt 安全漏洞 — openwrt | 8.8 | - | 2026-03-19 |
| CVE-2025-23384 | Siemens RUGGEDCOM和Siemens SCALANCE 缓冲区错误漏洞 — RUGGEDCOM RM1224 LTE(4G) EU | 3.7 | Low | 2025-03-11 |
| CVE-2024-41110 | Docker Engine 安全漏洞 — moby | 10.0 | Critical | 2024-07-24 |
| CVE-2024-39742 | IBM MQ Operator 安全漏洞 — MQ Operator | 8.1 | High | 2024-07-08 |
| CVE-2022-31802 | CODESYS Gateway Server 安全漏洞 — CODESYS Gateway Server V2 | 9.8 | Critical | 2022-06-24 |
CWE-187（部分比较） 是常见的弱点类别，本平台收录该类弱点关联的 13 条 CVE 漏洞。