CWE-269 特权管理不恰当 类弱点 1307 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-269 属于权限管理不当漏洞，指产品未能正确分配、修改、跟踪或检查用户权限，导致攻击者获得非预期的控制范围。攻击者常利用此缺陷提升权限或越权访问敏感资源。开发者应实施最小权限原则，严格验证每次操作的身份与权限，确保权限分配、变更及撤销过程的安全性与完整性，从而防止未授权访问。
def makeNewUserDir(username): if invalidUsername(username): #avoid CWE-22 and CWE-78 print('Usernames cannot contain invalid characters') return False try: raisePrivileges() os.mkdir('/home/' + username) lowerPrivileges() except OSError: print('Unable to create new user directory for user:' + username) return False return Trueseteuid(0); /* do some stuff */ seteuid(getuid());| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2021-37911 | BenQ EH600安全漏洞 — EH600 OTA | 8.8 | High | 2021-08-30 |
| CVE-2021-39167 | OpenZepplin 安全漏洞 — openzeppelin-contracts | 10.0 | Critical | 2021-08-26 |
| CVE-2021-39168 | OpenZepplin 安全漏洞 — openzeppelin-contracts-upgradeable | 10.0 | Critical | 2021-08-26 |
| CVE-2021-24602 | WordPress plugin HM Multiple Roles 安全漏洞 — HM Multiple Roles | 8.8 | - | 2021-08-23 |
| CVE-2021-24038 | Facebook Oculus Desktop 安全漏洞 — Oculus Desktop | 7.8 | - | 2021-08-18 |
| CVE-2021-34745 | AppDynamics.NET Agent for Windows 安全漏洞 — AppDynamics .NET Agent for Windows | 7.8 | High | 2021-08-18 |
| CVE-2021-37627 | Contao 权限许可和访问控制问题漏洞 — contao | 8.0 | High | 2021-08-11 |
| CVE-2021-33526 | MB connect line mbDIALUP 安全漏洞 — mbDIALUP | 7.8 | High | 2021-08-02 |
| CVE-2021-31581 | Akkadian Provisioning Manager 安全漏洞 — Provisioning Manager Engine (PME) | 7.9 | High | 2021-07-22 |
| CVE-2021-25442 | Samsung KCS授权问题漏洞 — Knox Mobile Enrollment | 9.1 | - | 2021-07-08 |
| CVE-2021-25429 | Bluetooth 安全漏洞 — Samsung Mobile Devices | 3.5 | - | 2021-07-08 |
| CVE-2021-25428 | PackageManager安全漏洞 — Samsung Mobile Devices | 7.8 | - | 2021-07-08 |
| CVE-2021-34621 | WordPress 访问控制错误漏洞 — ProfilePress | 9.8 | Critical | 2021-07-07 |
| CVE-2021-34622 | WordPress 安全漏洞 — ProfilePress | 9.8 | Critical | 2021-07-07 |
| CVE-2021-27661 | Johnson Controls Facility Explorer 安全漏洞 — Facility Explorer SNC Series Supervisory Controllers (F4-SNC) | 8.8 | High | 2021-07-01 |
| CVE-2021-33538 | Weidmueller Industrial WLAN 安全漏洞 — IE-WL(T)-BL-AP-CL-XX | 8.8 | High | 2021-06-25 |
| CVE-2021-34810 | Synology Download Station 安全漏洞 — Download Station | 9.9 | Critical | 2021-06-18 |
| CVE-2021-27483 | ZOLL Defibrillator Dashboard 安全漏洞 — ZOLL Defibrillator Dashboard | 7.8 | - | 2021-06-16 |
| CVE-2021-25418 | Samsung Mobile Samsung Internet 安全漏洞 — Samsung Internet | 7.8 | - | 2021-06-11 |
| CVE-2021-28814 | QNAP Systems NAS 安全漏洞 — Helpdesk | 8.8 | High | 2021-06-11 |
| CVE-2021-31839 | McAfee Agent安全漏洞 — McAfee Agent for Windows | 4.8 | Medium | 2021-06-10 |
| CVE-2021-27657 | Johnson Controls Metasys 安全漏洞 — Metasys | 8.8 | High | 2021-06-04 |
| CVE-2013-4536 | QEMU 安全漏洞 — qemu | 8.8 | - | 2021-05-28 |
| CVE-2021-22118 | Vmware Spring Framework 权限许可和访问控制问题漏洞 — Spring Framework | 7.8 | - | 2021-05-27 |
| CVE-2021-22733 | Schneider Electric homeLYnk和spaceLYnk 安全漏洞 — homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior | 7.8 | - | 2021-05-26 |
| CVE-2021-22732 | Schneider Electric homeLYnk和spaceLYnk 安全漏洞 — homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior | 7.8 | - | 2021-05-26 |
| CVE-2018-16497 | Versa Analytics 安全漏洞 — Versa Analytics | 7.8 | - | 2021-05-26 |
| CVE-2021-24289 | WordPress plugin 安全漏洞 — Store Locator Plus for WordPress | 8.8 | - | 2021-05-17 |
| CVE-2021-23891 | McAfee Total Protection 安全漏洞 — McAfee Total Protection (MTP) | 7.8 | High | 2021-05-12 |
| CVE-2021-21430 | OpenAPI Tools OpenAPI Generator 安全漏洞 — openapi-generator | 6.2 | Medium | 2021-05-10 |
CWE-269（特权管理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 1307 条 CVE 漏洞。